AIKIDO-2026-770744
python-benedict is vulnerable to Remote code execution
80
High Risk
This Affects:
python-benedictTL;DR
python-benedict's benedict() constructor, when format is omitted, calls autodetect_format() in benedict/dicts/io/io_util.py, which infers the deserialization format from a filepath, URL, or S3 key extension via get_format_by_path(). Prior to 0.40.0 this returned "pickle" for a pickle-suffixed source, and decode() then ran PickleSerializer.decode(), which base64-decodes the loaded text and calls pickle.loads(), executing arbitrary code in the process. Explicit from_* loaders pass a format and do not take this path; from_pickle remains an intentional opt-in. The fix returns None from autodetect_format() when the detected format is "pickle", so pickle decoding requires format="pickle" or from_pickle().
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and construct a benedict dict from a filepath, URL, or S3 path without passing an explicit format, when that path ends in a pickle extension.
Background info
python-benedict is vulnerable to Remote code execution in versions 0.18.1 - 0.39.0.
How to fix this
Upgrade the python-benedict package to version 0.40.0 or later.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.