Critical · published January 21, 2026
🔥 An undocumented feature in the PLY library lets attackers execute any code they want—just by passing a sneaky `.pkl` file! Think of this like a secret door in a hotel that the staff forgot to mention. Anyone with the right trick can slip in undetected, just like the malicious pickle file can gain entry into your code without validation. An attacker could leverage this vulnerability to run arbitrary code on your system, potentially leading to data breaches, unauthorized access, or total system compromise. This means they could steal sensitive information, change your application behavior, or even deploy malware—all from just a crafty `.pkl` file!
Think of this like a secret door in a hotel that the staff forgot to mention. Anyone with the right trick can slip in undetected, just like the malicious pickle file can gain entry into your code without validation. This critical vulnerability in the PLY library occurs because the `picklefile` parameter in the `yacc()` function deserializes input using `pickle.load()` without any security checks, allowing execution of embedded code while the feature remains undocumented and active in PyPI.
An attacker could leverage this vulnerability to run arbitrary code on your system, potentially leading to data breaches, unauthorized access, or total system compromise. This means they could steal sensitive information, change your application behavior, or even deploy malware—all from just a crafty `.pkl` file! Immediately patch your PLY library to a secure version, if available. Review your code to remove any reliance on the `picklefile` parameter, and consider using safer alternatives for serialization like JSON. Conduct a full audit of your codebase to identify other potential risks. You've got this! With these steps, you’ll be back to securing your applications in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| dabeaz/ply | all versions | — |