How can deserializing data with pickle from an untrusted source lead to remote code execution?

pickle is a Python-specific serialization format that can represent almost any object, including classes and functions. During unpickling, pickle reconstructs objects by calling constructors and the reduce protocol. An attacker can craft a byte stream whose reduce returns a callable such as os.system and arguments to execute. When the victim unpickles that stream, the callable runs immediately, before any validation you might add afterwards. There is no safe mode and no way to inspect a pickle before loading it that is guaranteed to be safe, because the payload only needs to be valid enough to reach the callable. The practical rule is simple: never unpickle data from an untrusted source. Use json, msgpack, protobuf, or another data-only format, and validate with a schema. If you must transfer Python objects, restrict them to trusted systems with network controls and authentication, and sign or encrypt the payload.