If you unpickle data someone else sends you, you’re playing with fire. I don’t see the risk in pickling your own data, say to cache it to disk, then reloading i

If you unpickle data someone else sends you, you’re playing with fire. I don’t see the risk in pickling your own data, say to cache it to disk, then reloading it later. An attacker could hack the store? If they have that access then all bets are already off. I suppose if a remote store is involved then the attack would be easier: you don’t need to hack the server running my code, just the DB/KV-store/whatever storing the pickles. Is that a common use case though? It seems like JSON and other dedicated formats are vastly more common for serializing data across machine boundaries.