Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code via `__reduce__()`, an attacker can achieve code execution by passing a malicious pickle file. The parameter is not mentioned in official documentation or the GitHub repository, yet it is active in the PyPI version. This introduces a stealthy backdoor and persistence risk. NOTE: A third-party states that this vulnerability should be rejected because the proof of concept does not demonstrate arbitrary code execution and fails to complete successfully.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
PLY 安全漏洞
Vulnerability Description
PLY是B07个人开发者的一个Python库。 PLY 3.11版本存在安全漏洞，该漏洞源于yacc函数的picklefile参数未经验证地反序列化pickle文件，可能导致远程代码执行。
CVSS Information
N/A
Vulnerability Type
N/A