Catch Python’s unsafe loaders and shell calls

Jun 20, 2026 · 1 min read

Python hides RCE in convenience functions. Prioritize deserialization and shell execution sinks.

bash

grep -rEn "pickle.loads|yaml.load(|marshal.loads|jsonpickle|dill.loads" --include=*.py .
grep -rEn "subprocess.(call|run|Popen).*shells*=s*True|os.system|os.popen" --include=*.py .

Then check whether the argument is tainted.

python

yaml.load(request.data)          # use yaml.safe_load
subprocess.run(f"ping {host}", shell=True)  # command injection via host

Pro note: yaml.load without SafeLoader instantiates arbitrary Python objects, which is RCE, not just parsing. For subprocess, argument lists without a shell are safe; the bug is the shell string. Also flag eval, exec, and __import__ on request data.