Deserialization Of Pickled Message

Celery is vulnerable to deserialization attacks. The default configuration in Celery allows for the deserialization of pickled messages, even if it is configured to send messages in the JSON format. This is because the acceptcontent setting by default is set to: app.conf.acceptcontent = 'json',...