fix(security): replace unsafe pickle.loads with SafeUnpickler for CVE-2026-3989 (#20904)

2026-03-27 00:43:41 -07:00
parent 8d4fca5908
commit 5fc5c18bed
3 changed files with 9 additions and 2 deletions
@@ -2144,6 +2144,11 @@ class SafeUnpickler(pickle.Unpickler):
        )


+def safe_pickle_load(fp):
+    """Drop-in replacement for pickle.load() that blocks unsafe class loading."""
+    return SafeUnpickler(fp).load()
+
+
 def debug_timing(func):
    # todo: replace with a more organized instrumentation
    def wrapper(*args, **kwargs):