Insecure deserialization (ARCH2109)

Key python.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Tools like pickle and yaml.load can construct arbitrary objects and code during deserialization. Loading untrusted data with them is a classic remote-code-execution vector.

Incorrect

import pickle

def load(request):
    return pickle.loads(request.body)

Correct

import json

def load(request):
    return json.loads(request.body)

Fix

For untrusted data, use data-only formats like JSON or yaml.safe_load instead of pickle/yaml.load.