Our company utilizes the pandas library extensively in our software. However, Fortify, our security analysis tool,** flags pandas as having a critical vulnerability due to the read_pickle function**, which has the potential to execute malicious code. Note that we do not use the read_pickle function in our codebase, but Fortify still identifies this as a critical issue.
We have tried to solve this by importing only specific submodules of pandas that we use (to avoid importing the entire library) but Fortify continues to detect the critical vulnerability associated with read_pickle.
from pandas import DataFrame, Series, read_csv
However, Fortify continues to flag the vulnerability.
We wonder if there is a solution to this issue. Is there a way to structure our imports or configure pandas to avoid including read_pickle entirely?
Alternatively, is it possible to address this concern directly within the pandas library to enhance its security profile?
Francisco Sánchez is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.