PyPI/fickling CVE-2026-22609: unknown, EPSS 0.63%

Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Action: Upgrade fickling to 0.1.7 or later.

pip install fickling==0.1.7

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1372
• https://github.com/trailofbits/fickling/security/advisories/GHSA-q5qq-mvfm-j35x
• https://nvd.nist.gov/vuln/detail/CVE-2026-22609
• https://github.com/trailofbits/fickling/pull/195
• https://github.com/trailofbits/fickling/commit/29d5545e74b07766892c1f0461b801afccee4f91
• https://github.com/trailofbits/fickling/commit/6b400e1a2525e6a4a076c97ccc0d4d9581317101
• https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66
• https://github.com/trailofbits/fickling/commit/b793563e60a5e039c5837b09d7f4f6b92e6040d1
• https://github.com/trailofbits/fickling/commit/eb299b453342f1931c787bcb3bc33f3a03a173f9
• https://github.com/trailofbits/fickling
• https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L88
• https://github.com/trailofbits/fickling/releases/tag/v0.1.7
• https://pypi.org/project/fickling
• https://github.com/advisories/GHSA-q5qq-mvfm-j35x

CVE-2026-22609 · published 2026-07-07T16:03:17.761266Z · modified 2026-07-07T17:47:14.888738770Z · JSON