Get Set, Exploit - Unveiling Python Class Pollution In the Wild

The talk opens with Python's object model, where everything is an object linked by references and dunder attributes. Dynamic reflection such as getattr and setattr lets attacker-supplied keys walk that graph, so a recursive updater can reach classes, modules and secrets far beyond the object it was meant to touch. The speakers trace the history from a 2023 blog post to a 2024 PyTorch Lightning CVE, arguing that those were only the visible part.

The core contribution is a taxonomy built from two get primitives and three set primitives, yielding six pollution types, of which only one was previously known. The team then built Pyrl, which applies a new static analysis called operational taint analysis. Run across more than 600,000 GitHub and PyPI packages, it produced 886 alerts, and the researchers report 47 exploitable zero-days in projects including Azure CLI, Taipy and ComfyUI.

Case studies show how these flaws become serious. In Django Unicorn, an unauthenticated state-update API allowed denial of service, cross-site scripting through BeautifulSoup's sanitization table, forged signing secrets, and remote code execution. A second case, in TypeY, started from a weak constrained primitive and needed a race condition to reach eval. The takeaway for developers is to restrict which attributes can be traversed and to validate the final target before any assignment.