explosion / srsly

🦉 Modern high-performance serialization utilities for Python (JSON, MessagePack, Pickle)
MIT License
438 stars 31 forks source link

Deserialization Vulnerability #27

Closed iaskwho closed 4 years ago

honnibal commented 4 years ago

This is a standard expected behaviour of the Python Pickle format: Pickle is fundamentally unsafe for untrusted payloads. The same behaviour will be found in the standard library's pickle module. See here:

https://docs.python.org/3/library/pickle.html