Python Static Analyzer Fickling Vulnerability in Unsafe Imports Method
CVE-2026-22609
8.9HIGH
What is CVE-2026-22609?
The Fickling static analyzer, a tool used for Python pickling analysis, contains a significant vulnerability in the unsafe_imports() method. Prior to version 0.1.7, this method fails to identify multiple dangerous Python modules capable of executing arbitrary code, leaving the system open to potential exploitation. Attackers could create malicious 'pickles' that import these modules without being flagged as unsafe, which compromises the static safety checks that Fickling is designed to enforce. The issue has been rectified in version 0.1.7, highlighting the importance of regular updates to mitigate such risks.
Affected Version(s)
fickling < 0.1.7