Is python pickle safe?

Question

Python

There is some application that provides for the exchange of data between users, as well as uploading data to the site. The application is written in python, the data is serialized using cPickle.
Is this approach safe, and can an attacker put code there that will be executed? I feel with my heels that yes, but I can’t prove it)

Answer 1

docs.python.org/library/pickle.html
"Warning: The pickle module is not intended to be secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source."

Answer 2

You can try Google protocol buffers , although the implementation in python is younger than in C ++, but it works very well.