Verified65% confidenceFactExact time
Python pickle格式在反序列化时可以执行任意代码，攻击者可以在模型文件中嵌入恶意代码
3
Sources
65%
Confidence
Long-term
Relevance
8/9/2026
First Seen
Sources
OpenAI意外DDoS攻击Hugging Face事件复盘与启示
Related Claims
UnverifiedPython's pickle module executes arbitrary Python code during deserialization, posing a security risk of remote code execution via maliciously crafted files.78% similarUnverified早期的 PyTorch .pt 文件使用 Python 的 pickle 序列化，存在可执行任意代码的安全隐患77% similarUnverifiedPython的eval()函数能执行任意Python表达式，恶意用户可通过构造特殊输入执行危险系统命令，构成代码注入风险64% similarUnverifiedIn the case study, DeepSeek series models were used to assist in generating Python crawler code and to automatically complete debugging.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/720684API
curl https://kongchang.com/api/v1/knowledge/claims/720684MCP
get_claim(id=720684)