Qualified static finding recorded.
CodeVetter · local evidence export
Insecure pickle deserialization in Python
codevetter-public-benchmark/py-insecure-deserialization
detected · high confidence
Verification
No exact-current runtime evidence is included.
No audience validation occurred.
Finding
insecure deserialization
pickle.loads is called on a user-supplied base64 blob. pickle can execute arbitrary code during deserialization, so untrusted input lets an attacker run any payload on the server.
source.py:9