CVE-2026-22606

CVE-2026-22606 describes a vulnerability in Fickling versions up to 0.1.6, a Python pickling decompiler and static analyzer. The flaw causes Fickling to misclassify malicious pickles utilizing Python's runpy module as SUSPICIOUS instead of OVERTLY_MALICIOUS, potentially leading users to execute attacker-controlled code. With a CVSS score of 7.8 (HIGH), this vulnerability involves a local attack vector with low complexity, requiring user interaction, and can result in high impact to confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.