I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting to "never unpickle data received from an untrusted or unauthenticated source" but I can think of a hazard coming from supposedly trusted (but compromised) source.

As Python is a flexible, dynamic language it does not require a wizard to create an old-school computer virus infecting pickles.

Are there any known cases of such viruses?


By "a virus" I mean literally old good "computer virus": a program that proliferates by adding itself to other programs.

1 Answer 1


If by "virus" you mean "exploit", then you can easily find those even on StackOverflow.

There's probably no widespread malware based on that, partly because there's only little number of applications for popular desktop platforms like Windows that are written in Python, and it's unlikely that any of them indeed uses pickle for the remote data (un-)serialization. However, a Python developer should better avoid a false sense of security here, because it's too simple to write such a malware, as is demonstrated above.

  • No, by "a virus" I mean old good "computer virus" as defined in 80' and 90': a program that replicates itself by adding itself to code of another program (since pickled data occured to be a program too).
    – abukaj
    Commented Feb 3, 2018 at 19:55
  • @abukaj what's the purpose of such a knowledge?
    – ximaera
    Commented Feb 3, 2018 at 19:56
  • curiousity and possible leverage when I warn my colleagues (data scientists using Python) about my finding on Monday. Also pride in case I am the first author of such virus. ;-)
    – abukaj
    Commented Feb 3, 2018 at 20:02
  • @abukaj if there are some, no one knows about them. If you'll write one, no one except your colleagues will know either.
    – ximaera
    Commented Feb 3, 2018 at 20:24
  • I hope you are right.
    – abukaj
    Commented Feb 4, 2018 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .