Pickle Vulnerability
Domain: Security
🎯 Motivation
Python’s pickle module can execute arbitrary code during deserialization. Loading an untrusted pickle is as dangerous as running a stranger’s script on your machine.
đź“‹ Concrete Example
pickle.load(open("data.pkl", "rb")) on an attacker-crafted file can run os.system("rm -rf /"). Use JSON or msgpack for untrusted data — they deserialize data, not code.
đź”— Analogy
Accepting a sealed envelope is safe, but a package that says “open and follow instructions inside” could tell you to do anything. Pickle is the second kind — never trust its contents.