CVE-2026-22607: Fickling Package cProfile Blocklist Bypass Leading to Arbitrary Code Execution

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Fickling is a Python package designed to analyze and assess the safety of pickle files, which are used for serializing and deserializing Python objects. It provides a security gate to prevent the execution of malicious code during the deserialization process. However, certain versions of Fickling have a critical vulnerability that allows attackers to bypass its safety mechanisms, specifically by exploiting the cProfile module, which is not included in its blocklist of unsafe imports.

Vulnerability Detail

The vulnerability arises from Fickling versions up to and including 0.1.6 not treating Python's cProfile module as unsafe. This oversight allows a malicious pickle file that utilizes cProfile.run() to be misclassified as SUSPICIOUS instead of OVERTLY_MALICIOUS. As a result, users relying on Fickling's output may inadvertently execute attacker-controlled code, leading to arbitrary code execution. The root cause is the absence of cProfile in the unsafe imports blocklist within Fickling's analysis module, which compromises the integrity of the security checks.

pip install --upgrade "fickling==0.1.12"

pip install --upgrade "fickling==0.1.7"

Workaround

As a temporary workaround, users can manually inspect pickle files for the presence of cProfile before deserialization. Additionally, they can implement custom safety checks to analyze the contents of the pickle files. Here is an example of how to create a malicious pickle for testing purposes:

import pickle
import cProfile

class MaliciousPayload:
    def __reduce__(self):
        return (cProfile.run, ("print('CPROFILE_RCE_CONFIRMED')",))

with open("malicious.pkl", "wb") as f:
    pickle.dump(MaliciousPayload(), f)

Conclusion

The vulnerability in Fickling related to the cProfile module poses a significant risk by allowing attackers to execute arbitrary code through malicious pickle files. Users are strongly advised to update to the latest version to mitigate this risk. Implementing additional safety checks can also help in the interim.

See every vulnerability recorded for fickling →

FAQ