| عنوان | pytries datrie 0.8.3 Deserialization |
|---|
| الوصف | RCE via Insecure Deserialization in datrie.Trie.load() using pickle
The datrie.Trie class relies on pickle.load() to restore its internal state when loading trie files through methods such as Trie.load(), Trie.read(), and Trie.__setstate__(). Because Python’s pickle mechanism allows execution of arbitrary code during deserialization, a specially crafted .trie file can include a malicious payload that gets executed as soon as it is loaded. This behavior is not obvious to users, since the deserialization happens implicitly within what appears to be a standard data-loading API. As a result, applications may unknowingly introduce a critical security risk.
It’s important to note that the datrie.BaseTrie class is not affected, as it does not use pickle for deserialization. However, any application that processes .trie files from untrusted sources—such as user uploads, shared storage, or external datasets—can be vulnerable to arbitrary code execution.
Note: The vendor has been notified through github public issue 15 days ago but it seems the repo is not maintained. |
|---|
| المصدر | ⚠️ https://github.com/pytries/datrie/issues/109 |
|---|
| المستخدم | dhabaleshwar (UID 58737) |
|---|
| ارسال | 05/04/2026 06:18 PM (6 أشهر منذ) |
|---|
| الاعتدال | 06/04/2026 11:23 PM (1 day later) |
|---|
| الحالة | مكرر |
|---|
| إدخال VulDB | 355483 [pytries datrie حتى 0.8.3 trie File src/datrie.pyx Trie.load/Trie.read/Trie.__setstate__ تجاوز الصلاحيات] |
|---|
| النقاط | 0 |
|---|