Dhondtao

**Name of the Vulnerable Software and Affected Versions** parso versions through 0.4.0 **Description** A deserialization vulnerability exists in the way parso handles grammar parsing from the cache. Cache loading relies on pickle, and if an evil pickle can be written to a cache grammar file and its parsing can be triggered, this flaw leads to Arbitrary Code Execution. This issue is disputed because the cache directory is not under the control of the attacker in any common configuration. **Recommendations** For parso versions through 0.4.0, consider disabling the cache loading feature that relies on pickle until a patch is available. Restrict access to the cache directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.