YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
Malicious Pickle Proof-of-Concept (PoC)
This repository contains a deliberately crafted .pkl file that demonstrates a well-known security vulnerability in Python's pickle module — arbitrary code execution via unsafe deserialization.
🔐 Vulnerability Summary
- Format:
.pkl - Type: Insecure Deserialization → Arbitrary Code Execution (ACE)
- Method: Uses
__reduce__()in a custom Python class to trigger execution of an OS command at load time. - PoC File:
malicious.pkl
⚠️ Security Warning
This file is intentionally malicious. Do not deserialize (pickle.load) it on any machine you don't control. It will run a harmless OS command for demonstration, but the technique can be used to run any code.
🧪 Reproduction Instructions
Run the following to reproduce the issue safely:
python3 -c "import pickle; pickle.load(open('malicious.pkl', 'rb'))"
Expected output: Malicious pickle loaded successfully! UID=...
The command is executed via os.system() during deserialization.
📉 Impact Remote Code Execution on the system loading the pickle file.
Full compromise if attacker supplies the pickle.
Demonstrates the risk of loading untrusted .pkl files.
✅ Mitigations Do not use pickle.load() on untrusted input.
Prefer secure serialization formats such as safetensors, JSON, or ONNX.
If unavoidable, use strong sandboxing or input validation.