Spaces:

Architect8999
/

rhodawk-ai-devops-engine

Sleeping

rhodawk-ai-devops-engine / architect /skills /web /deserialization-python.md

Rhodawk Agent

feat(v6): Masterplan build — semantic skill selector, 84 skills, night-hunt orchestrator, OpenClaw gateway, 12 MCP servers, developer playbook

58fe8fa 3 months ago

preview code

Raw

History Blame Contribute Delete

635 Bytes

metadata

name: deserialization-python
domain: web
triggers:
  languages:
    - python
severity_focus:
  - P1
  - P2
  - P3

deserialization-python

Python deser: pickle (any unpickle of untrusted data is RCE), PyYAML yaml.load() pre-5.1, marshal, jsonpickle, dill. Detection: any *.load(...) on user-controlled bytes.

Detection checklist

enumerate exposure
match canonical sinks
confirm reproducibility
map to CWE / OWASP / CVSS

Exploitation primitives

reproduce in lab
minimise the PoC
assess blast radius

Reporting fingerprint

include affected version range
include suggested fix snippet
include CVSS 3.1 vector