performing-security-code-review

This module is a purposely vulnerable code demonstrator that includes multiple high-severity security antipatterns. Most critically, it provides an explicit, actionable insecure deserialization RCE primitive using pickle.loads on base64-decoded attacker-controlled data, and it embeds a malicious pickle gadget whose __reduce__ is designed to execute a destructive shell command (rm -rf /) upon deserialization. It also contains straightforward command injection via subprocess.run(shell=True with concatenated input), path traversal via unsanitized file path joins, and injection patterns for SQLi/XSS. As a dependency, this is unacceptable except for isolated, controlled training use.