21
Stop using pickle already. Seriously, stop it! (mina86.com)
submitted 2 days ago by mina86@lemmy.wtf to c/python@programming.dev
5 comments fedilink hide all child comments

It is common knowledge that pickle is a serious security risk. And yet, vulnerabilities involving that serialisation format keep happening. In the article I shortly describe the issue and appeal to people to stop using pickle.

you are viewing a single comment's thread
view the rest of the comments
[-] mina86@lemmy.wtf 3 points 1 day ago

Joblib has the same drawback as pickle. From the documentation:

joblib.dump() and joblib.load() are based on the Python pickle serialization model, which means that arbitrary Python code can be executed when loading a serialized object with joblib.load().

joblib.load() should therefore never be used to load objects from an untrusted source or otherwise you will introduce a security vulnerability in your program.

this post was submitted on 10 Feb 2026
21 points (88.9% liked)

Python

7751 readers
4 users here now

Welcome to the Python community on the programming.dev Lemmy instance!

📅 Events

PastNovember 2023

October 2023

July 2023

August 2023

September 2023

🐍 Python project:
💓 Python Community:
✨ Python Ecosystem:
🌌 Fediverse
Communities
Projects
Feeds

founded 2 years ago
MODERATORS
erlingur@programming.dev
jnovinger@programming.dev
norambna@programming.dev