Zennoxa Shield
Rules / Python
SHIELD-PY-003

Dangerous pickle deserialization

criticalPythonCWE-502CVSS 9.8

What it detects

Deserializing untrusted data with pickle can lead to arbitrary code execution.

How to fix

Use JSON or another safe serialization format instead of pickle for untrusted data.

Vulnerable — Shield flags thisprofiles.py
import pickle
from flask import Flask, request

app = Flask(__name__)

@app.route("/import", methods=["POST"])
def import_profile():
    profile = pickle.loads(request.data)
    return {"name": profile["name"]}
Fixed — scans cleanprofiles.py
import json
from flask import Flask, request

app = Flask(__name__)

@app.route("/import", methods=["POST"])
def import_profile():
    profile = json.loads(request.data)
    return {"name": profile["name"]}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-003: Dangerous pickle deserialization — Zennoxa Shield