Unsafe Pickle Deserialization RCE in PLY 3.11 yacc()

This eight-file repository is a self-contained Docker reproduction harness for CVE-2025-56005 in PLY 3.11. The Python attacker program serializes an object whose __reduce__ method requests os.system execution and writes it as a malicious parser-table pickle. The Python victim program subsequently calls ply.yacc.yacc(picklefile=TABLE), causing vulnerable PLY to pickle.load the attacker-controlled file and execute the command in the victim process context. The hard-coded demonstration command only creates a PWNED_PROOF marker containing the victim username and timestamp. Docker Compose models the required trust boundary with separate attacker and victim containers, an unprivileged victim user, a shared named volume, and network_mode: none; the attacker is limited to writing /shared/parsetab.pkl. Dockerfile, Makefile, and run_demo.sh support vulnerable ('before') and hardened-fork ('after') comparisons. The hardened fork is expected to reject pickle globals before command execution. No external endpoint is contacted during runtime, although builds may install the hardened fork from its GitHub URL.

Repository purpose: a small Python project intended to reproduce and critique an alleged PLY 3.11 RCE (referenced as CVE-2025-56005) and argue for rejection. Structure: README.md explains that the copied PoC in main.py fails (AttributeError) and does not demonstrate cross-process untrusted data flow; main.py contains the only code. Exploit mechanics in main.py: it crafts a dictionary mimicking PLY yacc parsing tables and embeds an object (Exploit) whose __reduce__ returns (os.system, (cmd,)), then pickles this structure to a local file exploit.pkl. It then calls ply.yacc.yacc(picklefile='exploit.pkl', debug=False, write_tables=False) and parses the token 'example'. If PLY unpickles attacker-controlled parser tables unsafely, unpickling would execute the payload command, creating /tmp/pwned and writing 'VULNERABLE'. No network exploitation is implemented; the attack vector is local and depends on a victim process loading an attacker-supplied picklefile. The repository includes pyproject.toml and uv.lock to pin ply==3.11 and provide reproducible setup via uv.