Skip to content

Insecure Deserialization with Pickle in Pandas

Description

Functions reliant on pickle can result in arbitrary code execution. Consider using a safer serialization method like JSON or MessagePack.

Examples

Insecure Code

python
pandas.read_pickle('example.pkl')

Secure Code

python
import json; json.load(open('example.json'))

Remediation

Replace pickle with a safer serialization method such as JSON or MessagePack.

Rule Details

FieldValue
IDCODE-0216
CategoryDeserialization
SeverityCRITICAL
CWECWE-502
ConfidenceMEDIUM
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagspickle, deserialization
OWASPN/A

References