8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22612

CVE-2026-22612: Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22612

CVE-2026-22612:

8.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fickling	pip	<= 0.1.6	0.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in how the fickling library translates pickle bytecode into an Abstract Syntax Tree (AST) for security analysis. Specifically, the run methods within the Global, StackGlobal, and Inst opcode handler classes in fickling/fickle.py contained a conditional check that explicitly prevented the creation of ImportFrom AST nodes for any modules named __builtin__, __builtins__, or builtins.

The root cause of the vulnerability is this intentional omission. The developers likely assumed that imports from builtins were always safe and did not need to be represented in the AST to reduce noise. However, the builtins module contains dangerous functions like __import__ and eval. By crafting a pickle payload that uses opcodes like GLOBAL (c) to import builtins.__import__, an attacker could execute arbitrary code, and fickling's analysis would be completely blind to it because no corresponding import node was ever generated for inspection.

The patch rectifies this by removing the conditional check entirely. Now, an ImportFrom AST node is generated for every import, regardless of the module. This ensures that the security analysis phase has full visibility into all imports, including those from builtins, and can correctly flag them as unsafe.

Vulnerable functions

Global.run

fickling/fickle.py

The `run` method of the `Global` class, which handles the 'c' (GLOBAL) pickle opcode, intentionally skipped generating an AST import node if the module was `__builtin__`, `__builtins__`, or `builtins`. This allowed an attacker to import dangerous functions from `builtins` (like `__import__`) without being detected by the security analysis, leading to a bypass.

StackGlobal.run

fickling/fickle.py

Similar to `Global.run`, the `run` method of the `StackGlobal` class, which handles the STACK_GLOBAL pickle opcode, also contained the vulnerability. It would not create an AST node for imports from `builtins`, blinding the security scanner to potentially malicious operations.

Inst.run

fickling/fickle.py

The `run` method of the `Inst` class, responsible for handling the 'i' (INST) pickle opcode, was also vulnerable. It failed to generate an AST import node for classes instantiated from the `builtins` module, allowing unsafe deserialization to bypass security checks.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.