Python — A Practical Guide

Problem Framing

Python's pervasive use in application development, from web services and data science to automation and AI, makes it a critical target for security practitioners. Its dynamic nature, extensive ecosystem of third-party libraries, and ease of use, while beneficial for development velocity, introduce a complex attack surface. Attackers exploit these characteristics to achieve various objectives, including remote code execution (RCE), data exfiltration, privilege escalation, and supply chain compromises. Understanding the common vulnerabilities and attack vectors within the Python ecosystem is paramount for building secure applications.

Core Mechanics

At its core, Python's security landscape is shaped by its language features and how developers interact with its vast library ecosystem. Key areas of concern include:

• Dynamic Execution and Evaluation: Functions like eval() and exec(), while powerful, can lead to arbitrary code execution if used with unsanitized user input. Similarly, insecure deserialization of untrusted data, particularly through modules like pickle, can allow attackers to execute arbitrary code by crafting malicious serialized objects. The __reduce__ method in pickle is a frequent target for such attacks ^[1][2].
• Module Import System: Python's flexible import mechanism can be hijacked. Malicious actors can create packages that, when imported, execute arbitrary code. Furthermore, files like .pth can be abused to register directories containing malicious modules or to execute code at interpreter startup, establishing persistence ^[3][4].
• Interfacing with the Operating System: Python's ability to interact with the host OS via modules like subprocess and os.system presents a significant risk. When commands are constructed from user-supplied input without proper sanitization, command injection vulnerabilities can arise ^[5].
• Package Management and Supply Chain: The Python Package Index (PyPI) is a central repository for third-party libraries. Attacks on the supply chain, including typosquatting, compromised accounts, or malicious package updates, can lead to the distribution of malware. Compromised CI/CD workflows, such as those in GitHub Actions, can also inject malicious code into packages destined for PyPI ^[6][7]. Leaked PyPI tokens are also a significant threat, exposing sensitive access ^[8].
• Serialization Vulnerabilities: Beyond pickle, other serialization formats and libraries can be vulnerable. For instance, PyYAML's default load function is unsafe, and specific libraries might have their own deserialization flaws that can lead to RCE or data leakage ^{[9][10][11][12][13]}.
• Input Validation Deficiencies: Inadequate validation of user-supplied input is a recurring theme. This can manifest as directory traversal vulnerabilities due to improper path handling, command injection, or even privilege escalation on specific platforms ^[14][15]. Malformed HTTP headers, especially the Host header, have also been found to lead to RCE in certain frameworks ^[16].
• LLM Application Security: The rise of AI and LLM applications introduces new attack vectors. These include injecting malicious code into AI/ML model metadata, exploiting vulnerabilities in frameworks like LangChain or CrewAI, or using AI-generated exploits ^[9][17].

Notable Techniques

Several specific techniques have been observed in the wild or identified as significant risks:

• Malicious Package Distribution: Attackers leverage PyPI to distribute malware disguised as legitimate libraries. Examples include the XCSSET malware in a Flutter package ^[18], the SilentSync RAT delivered via typosquatted packages like sisaws and secmeasure ^[19], and the elementary-data package that stole credentials and wallet files ^[20]. TeamPCP has been particularly active, compromising packages like LiteLLM for credential theft and persistence ^[3][21] and durabletask for infostealing and worm-like propagation ^[22][23]. The Ultralytics AI Library was compromised via GitHub Actions to inject a cryptominer ^[6].
• Abusing Python Startup Mechanisms: The .pth file mechanism allows arbitrary Python code to be executed when the interpreter starts. This is a common persistence technique used by malware, as seen with the LiteLLM trojanization ^[3][4].
• Insecure Deserialization for RCE: Beyond general pickle risks, specific libraries are prone to these vulnerabilities. The PLY library was found to be vulnerable to RCE via unsafe deserialization of an undocumented picklefile parameter ^[13]. Azure Core Python Library had a similar RCE vulnerability ^[11]. LangChain Core has seen vulnerabilities allowing secret extraction through serialization injection ^[9].
• Command and Code Injection: The use of eval() and subprocess.run() with unsanitized input remains a critical vector for code execution ^[24][5]. Exploiting Jinja2 template rendering can lead to XSS or RCE, particularly when handling XML attributes with spaces ^[25][17].
• Directory Traversal: Improper validation of file paths can allow attackers to access files outside of their intended directory, as observed in Flask-Admin ^[15].
• Supply Chain Compromises via CI/CD: Malicious code injection into GitHub Actions workflows or package build processes has been used to compromise packages and CI/CD pipelines themselves ^[6][20].
• Credential Theft and Data Exfiltration: Many compromised packages are designed to steal sensitive information. This includes credentials, wallet files, and API keys, often exfiltrated to attacker-controlled infrastructure ^{[22][23][20][21]}.
• Exploiting Kernel Vulnerabilities: While not strictly Python code issues, Python scripts are frequently used as proof-of-concept exploits for privilege escalation vulnerabilities in the Linux kernel, such as the "Copy Fail" vulnerability (CVE-2026-31431) ^[26][27][28].
• Bypassing Security Tools: Attackers actively seek ways to evade detection. This includes bypassing static analysis tools like picklescan by leveraging legitimate package operations or manipulating file structures ^[29][30]. Techniques like ZIP filename tampering and modifying file flag bits have also been used .
• LLM-Specific Attacks: Vulnerabilities in LLM frameworks, such as CrewAI, can lead to RCE, SSRF, and arbitrary file reads ^[13][31]. The SGLang vulnerability allows RCE via malicious GGUF model files and Jinja2 SSTI ^[17].

Detection & Prevention

Mitigating Python-specific security risks requires a multi-layered approach:

• Static Application Security Testing (SAST): Tools like Bandit, Semgrep, Snyk Code, Checkmarx, and GitHub Advanced Security (CodeQL) can identify common vulnerability patterns in Python source code, such as insecure use of eval, subprocess, and potential deserialization issues ^[32][33].
• Dynamic Application Security Testing (DAST): Tools like Wapiti can scan running web applications for common vulnerabilities.
• Software Composition Analysis (SCA): Tools like pip-audit and Safety identify known vulnerabilities in project dependencies. Generating Software Bills of Materials (SBOMs) using CycloneDX is also crucial.
• Dependency Management Best Practices: Use tools like uv, pipenv, or poetry to manage dependencies and pin versions. Regularly audit and update dependencies. Employing cryptographic hashes for pinning dependencies (e.g., via uv pip compile --generate-hashes) adds an extra layer of integrity protection ^[34].
• Secure Coding Practices:
  • Input Validation: Rigorously validate all user-supplied input, paying close attention to file paths, command arguments, and data structures.
  • Avoid Risky Functions: Minimize or eliminate the use of eval(), exec(), and os.system() with untrusted input. If they must be used, implement strict sanitization and sandboxing.
  • Secure Deserialization: Avoid deserializing data from untrusted sources. If necessary, use safer alternatives or strictly validate the serialized data before deserialization. For pickle, consider using libraries like Pickletools for disassembly and analysis, or avoid it altogether where possible.
  • Secrets Management: Never hardcode secrets (API keys, passwords, tokens) in source code. Utilize environment variables, dedicated secrets management systems (like AWS Secrets Manager, HashiCorp Vault), or OS-level credential storage (e.g., via the keyring library) ^[35].
  • Principle of Least Privilege: Ensure applications and their components run with the minimum necessary permissions.
  • Secure Configuration: Review configuration files for sensitive information and ensure they are protected. Disable debug modes in production environments.
  • Path Validation: Implement robust checks for directory traversal attempts.
  • HTTP Header Validation: Sanitize and validate HTTP headers, particularly those that can influence routing or parsing, such as the Host header ^[16].
  • Content Security Policy (CSP): Implement CSP headers to mitigate XSS attacks.
• Supply Chain Security:
  • Trusted Publishing: Utilize secure publishing workflows, such as Trusted Publishing with OIDC and Sigstore, to verify package origins and integrity ^[34].
  • Package Auditing: Regularly audit dependencies and be wary of newly published or suspicious packages. Tools like Sonatype's automated tooling and Checkmarx Malicious Package Identification can assist ^[34].
  • CI/CD Security: Secure CI/CD pipelines. Use tools like zizmor to audit GitHub Actions workflows. Avoid storing sensitive credentials directly in CI/CD configurations; use integrated secrets management.
• Runtime Security: Tools like Manhole (with extreme caution) can provide interactive debugging capabilities into running processes, which can be useful for incident response, but also pose risks if exposed ^[36][37]. Sandboxing techniques using seccomp and setrlimit can restrict the system calls and resources available to Python processes ^[38].
• LLM Application Security: Employ specialized scanning tools like Prisma AIRS for AI/ML models. Sanitize inputs to LLM functions and avoid executing LLM-generated code directly without strict validation and sandboxing ^[17].

Tooling

A range of tools are available to aid Python application security practitioners:

• SAST: Bandit, Semgrep, Snyk Code, Checkmarx SAST, Veracode, GitHub Advanced Security (CodeQL), GitLab SAST, Aikido ^[32][33].
• Dependency Scanning: pip-audit, Safety, CycloneDX ^[34].
• Secrets Scanning: GitGuardian Public Monitoring, GitGuardian ^[8].
• Vulnerability Management: Snyk Code, Snyk Agent Fix, NIST SAMATE.
• Package Management: uv, pipenv, poetry ^[34].
• Web Vulnerability Scanning: Wapiti, OWASP ZAP, Burp Suite ^[39].
• Deserialization Analysis: Picklescan, pickletools ^[29][30].
• SSRF Protection: Drawbridge ^[40].
• JWT Security: JWTAuditor.
• Network Analysis: Scapy, Impacket, Nmap, Mitmproxy, tcpdump, Wireshark ^[41][42].
• Reverse Engineering: dis module, haruspex, de4py, Radare2 (with plugins like r2pickledec) ^[43].
• Code Obfuscation/Deobfuscation: Various custom scripts and tools.
• Runtime Debugging: Manhole ^[36][37].
• Secure Publishing: Sigstore.
• CI/CD Auditing: zizmor.
• LLM Security: Prisma AIRS.

Recent Developments

The threat landscape for Python applications is constantly evolving:

• Sophistication of Supply Chain Attacks: Attackers are becoming more adept at compromising legitimate packages and CI/CD pipelines. The use of sophisticated tactics by groups like TeamPCP, targeting multiple popular packages and security tooling, highlights this trend ^[3][22][21].
• Exploitation of LLM Frameworks: New vulnerabilities are being discovered in AI/ML frameworks and libraries, such as LangChain, CrewAI, and SGLang, often related to insecure code execution or deserialization of model artifacts ^[31][9][17].
• Kernel Vulnerability Exploitation: Python scripts continue to be a primary tool for demonstrating and exploiting critical kernel vulnerabilities for privilege escalation on Linux systems ^[26][27][28].
• Bypassing Detection Tools: Adversaries are actively researching and implementing techniques to bypass security scanners, including those designed for specific formats like pickle files ^[29][30].
• RCE via Malformed Headers: The discovery of vulnerabilities like BadHost (CVE-2026-48710) in frameworks like Starlette demonstrates how seemingly minor issues in HTTP header parsing can lead to RCE, especially impacting AI agent deployments ^[16].
• AI in Attack and Defense: While tools like Snyk Agent Fix leverage AI for vulnerability remediation ^[44], there's a parallel track of AI-generated exploits and malware, creating an arms race ^[6].

Where to Go Deeper

For practitioners seeking to deepen their understanding and proficiency:

• OWASP Resources: The Open Web Application Security Project (OWASP) provides extensive documentation on web application security, including common vulnerabilities and secure coding practices. OWASP Pygoat is a practical resource for learning Django security ^[45][46].
• Security Blogs and Research: Regularly follow security research blogs from companies like Snyk, Wiz, Sonatype, Aikido, and Checkmarx, as well as independent researchers, for timely vulnerability analysis and attack trend insights ^{[18][44][47][25][6][3][4][22][23][48][20][27][9][10][11][17][49][50][19][7][21][1][2][12][13][29][51][30][40][52][53][54][38][39][41][35][43][55][42][56][57][58][59][60][61][62][63][37][64]}.
• Tool Documentation: Thoroughly understand the capabilities and limitations of SAST, DAST, SCA, and other security tooling. Dive into the documentation for tools like Bandit, Semgrep, uv, and Wapiti ^{[34][32][33][39]}.
• Python Security Documentation: Refer to the official Python documentation and community discussions on security best practices and potential pitfalls.
• CTFs and Practice Labs: Engage in Capture The Flag (CTF) competitions and use platforms like OWASP Juice Shop to gain hands-on experience in identifying and exploiting vulnerabilities in Python applications.
• Deep Dives on Specific Vulnerabilities: Study detailed analyses of specific CVEs and attack vectors, such as insecure deserialization ^{[1][2][12][13]}, command injection ^[5], and supply chain attacks ^{[6][3][22][19][7][21]}.
• Kernel Exploit Analysis: For those interested in privilege escalation, studying the Python scripts used to exploit Linux kernel vulnerabilities provides insight into exploit development ^[26][27][28].