CVE-2026-22607: 
Python vulnerability analysis and mitigation

CVE-2026-22607 is a blocklist bypass vulnerability in Trail of Bits' Fickling, a Python pickle security analysis tool, that allows malicious pickle files using cProfile.run() to be misclassified as SUSPICIOUS instead of OVERTLY_MALICIOUS. Affected versions are Fickling 0.1.6 and earlier; the issue was patched in version 0.1.7. The advisory was published on January 9, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 8.9 (High) (GitHub Advisory, Feedly).

The root cause is an incomplete blocklist of unsafe Python module imports in fickling/analysis.py (CWE-184: Incomplete List of Disallowed Inputs; CWE-502: Deserialization of Untrusted Data). Fickling's UnsafeImports analysis class does not include cProfile, cProfile.run, cProfile.runctx, or the underlying _lsprof C module in its list of dangerous imports. Because cProfile.run() accepts a Python code string and passes it directly to exec(), an attacker can embed arbitrary code execution within a pickle's __reduce__ method using cProfile.run as the callable. When Fickling analyzes such a pickle, only the UnusedVariables heuristic triggers, resulting in a SUSPICIOUS classification rather than OVERTLY_MALICIOUS — the same root cause pattern as CVE-2025-67748 (pty) and CVE-2025-67747 (marshal/types). The fix was applied in commit dc8ae12 by adding cProfile to the unsafe imports blocklist (GitHub Advisory).

Successful exploitation allows an attacker to achieve arbitrary code execution with the privileges of the user or process that deserializes the malicious pickle file. Because the attack is fully self-contained within the pickle (no external files required), it is particularly effective in automated pipelines such as ML model validation workflows, model hosting platforms (e.g., Hugging Face, MLflow), CI/CD pipelines, and security scanning tools that rely on Fickling as a security gate. Confidentiality, integrity, and availability of the affected system are all at high risk, and successful exploitation could enable lateral movement within the environment (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available in the GitHub security advisory and referenced in the fickling test suite (test/test_bypasses.py). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.068%, reflecting low but non-zero probability of exploitation in the near term (GitHub Advisory, Feedly).

1. Craft a malicious pickle: Using Python 3 with fickling 0.1.6 or earlier as the target validator, create a pickle file that uses cProfile.run() as the callable in __reduce__:

import pickle
import cProfile

class MaliciousPayload:
    def __reduce__(self):
        return (cProfile.run, ("__import__('os').system('id')",))

with open('malicious.pkl', 'wb') as f:
    pickle.dump(MaliciousPayload(), f)

2. Submit to a Fickling-gated pipeline: Upload or deliver malicious.pkl to any system that uses Fickling to validate pickle safety before deserialization (e.g., an ML model repository, CI/CD artifact pipeline).
3. Observe misclassification: Fickling analyzes the file and returns Severity.SUSPICIOUS (not OVERTLY_MALICIOUS) because cProfile is absent from the unsafe imports blocklist. The pipeline treats the file as acceptable.
4. Trigger deserialization: The victim system loads the pickle (e.g., pickle.load(open('malicious.pkl', 'rb'))), causing cProfile.run() to execute the embedded code string via exec(), achieving arbitrary code execution on the target system (GitHub Advisory).

• File System: Presence of pickle files (.pkl, .pickle) containing the byte sequence for cProfile and run as STACK_GLOBAL operands (opcodes \x8c followed by cProfile and run strings); unexpected files created by the deserialization process.
• Logs: Fickling scan results reporting Severity.SUSPICIOUS for pickle files that subsequently cause unexpected process behavior; Python interpreter logs showing cProfile-related profiling output during model loading.
• Process: Unusual child processes spawned by Python interpreter during pickle deserialization (e.g., sh, bash, curl, wget); unexpected network connections originating from a Python process loading a pickle file.
• Network: Outbound connections from ML pipeline or model-serving infrastructure to unknown external hosts immediately following pickle deserialization events (GitHub Advisory).

Upgrade Fickling to version 0.1.7 or later, which adds cProfile, cProfile.run, cProfile.runctx, and _lsprof to the unsafe imports blocklist (commit dc8ae12). Any system or workflow using Fickling 0.1.6 or earlier as a security gate for pickle deserialization should be updated immediately. As an interim measure, do not rely solely on Fickling's classification output for pickle safety decisions; implement defense-in-depth controls such as sandboxed deserialization environments, network segmentation, and principle of least privilege for processes that load pickle data (GitHub Advisory, Feedly).

The advisory was published by Trail of Bits maintainer thomas-chauchefoin-tob on January 9, 2026, and the fix was applied promptly via commit dc8ae12. The vulnerability is part of a series of similar blocklist bypass reports against Fickling (alongside CVE-2025-67747 and CVE-2025-67748), highlighting a systemic challenge in maintaining exhaustive blocklists for Python's extensive standard library. Security community coverage appeared on Bluesky and in threat intelligence aggregators shortly after disclosure (GitHub Advisory).