From "Insecurity and Python Pickles" (2024) <a href="https://news.ycombinator.com/item?id=39685128">https://news.ycombinator.com/item?id=39685128</a> :<p>> <i>There should be a data-only pickle serialization protocol (that won't serialize or deserialize code).</i><p>> <i>How much work would it be to create a pickle protocol that does not exec or eval code?</i><p>"Title: Pickle protocol version 6: skipcode pickles"
<a href="https://discuss.python.org/t/create-a-new-pickle-protocol-version-to-add-skipcode/48880" rel="nofollow">https://discuss.python.org/t/create-a-new-pickle-protocol-ve...</a>