Skip to content
Threat Feed

Tag

Pickle

1 brief RSS
critical advisory

pyLoad Arbitrary Code Execution via Malicious Session Deserialization

pyLoad is vulnerable to arbitrary code execution via an unprotected `storage_folder` configuration option, allowing an attacker with `SETTINGS` and `ADD` permissions to write a malicious pickle payload to the Flask session store and execute arbitrary code upon subsequent HTTP requests.

pyLoad rce pickle deserialization webserver
2r 4t 1c 2i