[Security] Unsafe pickle.load() deserialization in man.py:36

Severity: CRITICAL File: xonsh/completers/man.py:36 Code: OPTIONS = pickle.load(f)

Description: pickle.load() on untrusted data allows arbitrary code execution during deserialization. If the pickle file can be influenced by an attacker, this is a Remote Code Execution (RCE) vector.

Mitigation: Replace pickle with a safe serialization format (JSON, MessagePack) or use a sandboxed unpickler with restricted globals.

---

Found during automated security audit of gitsome (⭐7,675).