[BUG] 推荐系统 newsrec 迭代器构造函数加载 pickle dict 文件,导致序列化解析 RCE

recommenders/models/newsrec/io/mind_iterator.py

def load_dict(self, file_path): """Load a pickle file.""" with open(file_path, "rb") as f: return pickle.load(f) # :67 *** deserialization sink ***

Constructor (hparams pass-through chain :54-55):

self.uid2index = self.load_dict(hparams.userDict_file) # the other three dicts (wordDict_file etc.) follow the same path