Unverified70% confidenceFactExact time
Python's pickle module executes the code in the __reduce__ method during deserialization, which can be exploited to embed arbitrary code execution payloads in model files.
2
Sources
70%
Confidence
Long-term
Relevance
8/28/2026
First Seen
Sources
Related Entities
Related Claims
VerifiedPython pickle格式在反序列化时可以执行任意代码，攻击者可以在模型文件中嵌入恶意代码74% similarVerifiedPython's pickle module executes arbitrary Python code during deserialization, posing a security risk of remote code execution via maliciously crafted files.74% similarUnverifiedPython's pickle module uses a sequence of opcode virtual machine instructions to describe object reconstruction, where the GLOBAL opcode can import arbitrary Python modules and call functions within them during deserialization.74% similarUnverifiedPython's built-in ast module can parse source files and statically extract dependency information without actually executing the code.71% similarVerifiedPython provides the decimal module for handling precise decimal arithmetic.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/813589API
curl https://kongchang.com/api/v1/knowledge/claims/813589MCP
get_claim(id=813589)