Views
No views yet
mailcap.findmatchmailcap module (removed in Python 3.13) exposes findmatch() which executes mailcap entry test commands via os.system(). Neither scanner blocks mailcap imports.pickle.loads() imports mailcap.findmatchfindmatch(caps, type, 'view', filename) where caps contains a crafted entry with 'test': '<shell_command>'findmatch() internally runs os.system(test_command)malicious.pkl — Minimal pickle payload (140 bytes)poc.py — Python script that generates and demonstrates the payload