Executive brief
parso is a Python parsing library used by development tools and IDEs to analyze Python code. It caches parsed grammar using Python's pickle serialization format, which can be exploited if an attacker can write a malicious pickle file to the cache directory, potentially leading to arbitrary code execution when that cache is loaded.
Technical details
A deserialization vulnerability (CWE-502) exists in parso through version 0.4.0 where the cache loading mechanism uses Python's pickle module without proper validation. An attacker who can write a malicious pickle object to the grammar cache file can achieve arbitrary code execution when the cache is parsed. However, this vulnerability is disputed because it requires write access to the cache directory, which is typically not attacker-controlled in common configurations. The vulnerability affects all versions of parso up to and including 0.4.0.
Affected products
- parso parso through 0.4.0
Timeline
- 2019-06-13: disclosed
- 2019-07-03: other: Advisory withdrawn due to dispute