OpenProximity/rpyc — comment on commit 9916331c3811affbc3a77fe060d94fa5c6b1428c
File:  line 0
By tomerfiliba:

oh, i recalled the problem: it's a major security risk. someone could send you a maliciously crafted string starting with the ``BYVAL`` tag, so it would go on to ``pickle.loads()``. pickle is unsafe by nature, as it will imports modules and instantiate arbitrary classes -- this is basically like giving up on the security model of rpyc.

i remember we talked about it, but i forgot... sorry :)