base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load. https://nvd.nist.gov/vuln/detail/CVE-2014-3539
