漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
Vulnerability Description
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PLY 安全漏洞
Vulnerability Description
PLY是B07个人开发者的一个Python库。 PLY 3.11版本存在安全漏洞，该漏洞源于yacc函数的picklefile参数未经验证地反序列化pickle文件，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A