CVE-2026-22606

The record

Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicious pickle that uses runpy.run_path() or runpy.run_module() is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling’s output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization.

Affected packages

Related vulnerabilities

• GHSA-wfq2-52f7-7qvj Fickling has a bypass via runpy.run_path() and runpy.run_module() Same vulnerability
• GHSA-5hwf-rc88-82xm Fickling missing RCE-capable modules in UNSAFE_IMPORTS Also affects fickling
• GHSA-wccx-j62j-r448 Fickling has `always_check_safety()` bypass: pickle.loads and _pickle.loads remain… Also affects fickling
• GHSA-mhc9-48gj-9gp3 Fickling has safety check bypass via REDUCE+BUILD opcode sequence Also affects fickling
• GHSA-mxhj-88fx-4pcv Fickling: OBJ opcode call invisibility bypasses all safety checks Also affects fickling
• GHSA-83pf-v6qq-pwmr Fickling has a detection bypass via stdlib network-protocol constructors Also affects fickling
• GHSA-h4rm-mm56-xf63 Fickling vulnerable to detection bypass due to "builtins" blindness Also affects fickling
• GHSA-q5qq-mvfm-j35x Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist Also affects fickling