Why Python's Pickle Is Dangerous for Your Code

Why Python’s Pickle Might Be Dangerous for Your Code

If you’ve been writing Python for a while, you’ve probably used Python’s pickle module to save objects to disk or share them across a network. It's incredibly convenient — you can serialize almost any Python object in one line of code. But this convenience hides a serious security risk that many developers overlook.

I’ve seen it many times: developers use pickle to cache machine learning models, transfer configuration objects, or even store session data. And every time, I worry a little. Because pickle isn’t just a simple data format — it’s actually a stack-based virtual machine that can execute arbitrary code.

The core problem: Pickle executes code

Here’s what most people don’t realize. When you call pickle.load(), Python doesn’t just read bytes and convert them back to data. It actually reconstructs objects by calling functions and methods defined in the pickle bytecode. And if someone sends you a malicious pickle file, they can include instructions that run any Python code they want.

Think about it this way: you’re literally telling your program to listen to whatever instructions are in that pickle file. If the file came from an untrusted source, you’re essentially giving a stranger remote code execution access to your system.

Let me show you something that always makes fellow developers go quiet.

A simple example of how bad this can get

Imagine a web application that accepts a pickle file from users. Here’s what an attacker could send:

import pickle
import os

class Malicious:
    def __reduce__(self):
        return (os.system, ('rm -rf /',))

# Create the malicious pickle
malicious_data = pickle.dumps(Malicious())

If your server then runs pickle.loads() on this data? Goodbye filesystem. The __reduce__ method tells pickle how to reconstruct the object, and the attacker simply returns a command that wipes everything.

Now, you’re probably thinking: “But I’d never unpickle data from strangers.” And that’s exactly what every developer says right before a data breach.

Real-world impact is not theoretical

This isn’t just a thought experiment. There have been documented cases where pickle vulnerabilities led to serious issues. For example, in 2020, a popular machine learning library had a vulnerability where loading saved models could execute arbitrary code. The attack surface is real.

At PythonSkillset.com, we often work with teams building data pipelines or machine learning services. And time after time, we see developers implementing pickle-based caching without thinking about where the cached data comes from.

Safer alternatives for serialization

The good news? You don’t need pickle for most cases. Here are better options depending on what you’re doing:

For simple data structures — use JSON. It’s built-in, handles strings, numbers, lists, and dictionaries perfectly, and cannot execute code.

import json
data = {"user": "pythonskillset", "score": 42}
json.dumps(data)

For more complex data — try msgpack or ujson. They’re faster than pickle for many use cases and much safer.

For machine learning models — use joblib (which is pickle-based but more controlled) or export to ONNX format. Many modern frameworks now support safer serialization.

For custom objects — implement your own to_dict() and from_dict() methods. It takes slightly more code but gives you full control.

When you absolutely must use pickle

Sometimes you really do need pickle — for example, when working with complex Python objects that can’t easily be represented in JSON. In those cases, follow these rules:

1. Never unpickle data from untrusted sources
2. Always validate the source before unpickling
3. Use cryptographic signatures to verify integrity
4. Consider running unpickling in a sandboxed environment

The smart developer’s approach

Here’s what I tell everyone at PythonSkillset: treat pickle like a loaded gun. It’s powerful, but one mistake can cause catastrophic damage. Use it only when you fully control both the serialization and deserialization process.

If you’re building a service that accepts user input, just don’t use pickle. Period. The convenience isn’t worth the risk. And if you’re caching data internally, use safer formats unless you have a really good reason not to.

Python gives you amazing power with pickle. But with great power comes great security responsibility. Use it wisely, and your codebases will be safer for it.