base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.02975·Published 2018-04-06·Fixed in 0.11.0CWE-502