CVE-2026-22608: Fickling Vulnerable to RCE via ctypes and pydoc Gadget Chain
Summary
CVE-2026-22608: Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection. Affects fickling versions < 0.1.7. Fixed in 0.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fickling is a Python package designed for secure serialization and deserialization of Python objects, primarily using the pickle format. It aims to prevent remote code execution (RCE) vulnerabilities by scanning for unsafe imports. However, it has been found that certain modules, specifically ctypes and pydoc, were not adequately blocked, allowing attackers to exploit this oversight.
Vulnerability Detail
The vulnerability arises from the fact that both ctypes and pydoc modules are not explicitly blocked in Fickling. This oversight allows an attacker to chain these modules together to achieve remote code execution while the scanner still reports the file as likely safe. By using pydoc to locate ctypes functions, an attacker can execute arbitrary commands, leading to severe security implications.
How To Fix
Latest published version: 0.1.12 as of 23 Oct 2026
pip install --upgrade "fickling==0.1.12"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.7
This is the first release that contains the fix.
pip install --upgrade "fickling==0.1.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ctypes and pydoc modules in your serialized data until you can update to the patched version of Fickling.
Conclusion
The vulnerability identified as CVE-2026-22608 in the Fickling package poses a significant risk due to the improper handling of ctypes and pydoc modules, allowing for potential remote code execution. Users are strongly advised to update to the latest version to mitigate this risk.
See every vulnerability recorded for fickling →
FAQ
The CVSS score of this vulnerability is 8.9, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary commands on the server running the affected application.
Yes, version 0.1.7 and later of Fickling contains the necessary fixes to mitigate this vulnerability.
If you cannot update the package immediately, avoid using the ctypes and pydoc modules in your serialized data as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for fickling.
