| 제목 | pytries datrie 0.8.3 Deserialization |
|---|
| 설명 | RCE via Insecure Deserialization in datrie.Trie.load() using pickle
The datrie.Trie class relies on pickle.load() to restore its internal state when loading trie files through methods such as Trie.load(), Trie.read(), and Trie.__setstate__(). Because Python’s pickle mechanism allows execution of arbitrary code during deserialization, a specially crafted .trie file can include a malicious payload that gets executed as soon as it is loaded. This behavior is not obvious to users, since the deserialization happens implicitly within what appears to be a standard data-loading API. As a result, applications may unknowingly introduce a critical security risk.
It’s important to note that the datrie.BaseTrie class is not affected, as it does not use pickle for deserialization. However, any application that processes .trie files from untrusted sources—such as user uploads, shared storage, or external datasets—can be vulnerable to arbitrary code execution.
Note: The vendor has been notified through github public issue 15 days ago but it seems the repo is not maintained. |
|---|
| 원천 | ⚠️ https://github.com/pytries/datrie/issues/109 |
|---|
| 사용자 | dhabaleshwar (UID 58737) |
|---|
| 제출 | 2026. 04. 05. PM 06:18 (7 개월 ago) |
|---|
| 모더레이션 | 2026. 04. 06. PM 11:23 (1 day later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 355483 [pytries datrie 까지 0.8.3 trie File src/datrie.pyx Trie.load/Trie.read/Trie.__setstate__ 권한 상승] |
|---|
| 포인트들 | 0 |
|---|