Views
No views yet
python/pyarrow/types.pxi
Function: PyExtensionType autoload
CVE: CVE-2023-47248py_extension_type_auto_load = True by
default. When reading IPC/Parquet/Feather files, __arrow_ext_deserialize__
calls pickle.loads() on untrusted extension metadata, enabling RCE.1# Vulnerable path when reading IPC/Parquet files
2__arrow_ext_deserialize__(self, serialized):
3 return pickle.loads(serialized) # RCE!py_extension_type_auto_load = False1import pyarrow.ipc as ipc
2reader = ipc.open_file("malicious_pyarrow.arrow")
3table = reader.read_all() # RCE triggered