CVE-2019-12760

An attacker who can write files to the target filesystem (e.g., via a separate file-upload or write primitive) can compute the deterministic cache file path, write a malicious pickle payload to that location, and then trigger parso grammar processing. When `parso.load_grammar()` or `g.parse()` is called with `cache=True`, parso deserializes the pickle from the cache file without integrity checks [CWE-502]. The PoC [ref_id=1] demonstrates this by writing an evil pickle whose `__reduce__` method executes an arbitrary system command, achieving remote code execution when the grammar is loaded.

The vulnerability resides in parso's cache-loading mechanism, which uses Python's `pickle` module to deserialize grammar cache files. The PoC [ref_id=1] shows that `parso.load_grammar()` and `g.parse(path=..., cache=True, cache_path=...)` trigger loading of a `.pkl` cache file whose path is derived from a SHA-256 hash of the grammar file and the dummy path. The cache file path format is `{cache_path}/{implementation}-{version}-{pickle_version}/{grammar_hash}-{path_hash}.pkl` [ref_id=1].

The advisory does not include a published patch. The recommended remediation is to avoid using pickle for cache serialization or to ensure that cache files are stored in a directory that is not writable by untrusted users. The PoC author notes that the attack requires the attacker to be able to create folders and write files on the target [ref_id=1], which is disputed as not being a common configuration. Without a fix, users should disable caching or restrict write access to the cache directory.