What is the fundamental security flaw of using Python's standard pickle module to serialize and deserialize system session data or application states?

Answer as guest — Start Free Practice Test to earn Practice PointsHow to earn pointsAsk a question+3Answer a question+1Someone answers yours+1Your Q gets upvoted+1Pioneer bonus (first 5)+5, ask questions & climb the leaderboard!

A Pickled data cannot be transmitted over standard HTTPS web traffic.
B Deserializing a malicious pickle file can execute arbitrary code on the host machine instantly.
C It stores data in cleartext formats that any user can read.
D It only supports primitive integer data types.

Show answer and explanation

Answer: B. Deserializing a malicious pickle file can execute arbitrary code on the host machine instantly.

Answer: B) Deserializing a malicious pickle file can execute arbitrary code on the host machine instantly.
Explanation: The pickle module is not secure. When pickle.loads() processes an archive, it can invoke the object's __reduce__ method. If an attacker crafts a malicious pickle payload, they can force the application to execute arbitrary shell commands the exact moment the file is opened.

Answering after opening this box earns no Practice Points.

Rules for asking and answering

What is the fundamental security flaw of using Python's standard pickle module to serialize and deserialize system session data or application states?

More questions like this