Severity: CRITICAL
File: xonsh/completers/man.py:36
Code: OPTIONS = pickle.load(f)
Description: pickle.load() on untrusted data allows arbitrary code execution during deserialization. If the pickle file can be influenced by an attacker, this is a Remote Code Execution (RCE) vector.
Mitigation: Replace pickle with a safe serialization format (JSON, MessagePack) or use a sandboxed unpickler with restricted globals.
Found during automated security audit of gitsome (⭐7,675).
Severity: CRITICAL
File:
xonsh/completers/man.py:36Code:
OPTIONS = pickle.load(f)Description:
pickle.load()on untrusted data allows arbitrary code execution during deserialization. If the pickle file can be influenced by an attacker, this is a Remote Code Execution (RCE) vector.Mitigation: Replace
picklewith a safe serialization format (JSON, MessagePack) or use a sandboxed unpickler with restricted globals.Found during automated security audit of gitsome (⭐7,675).