@JaredDeckard I'm having trouble seeing how this constitutes a vulnerability. For a crafted
text
, it's true that
json.loads(text, object_hook=as_enum)
could return an arbitrary attribute of a global variable
to the calling code, but that's already available to the calling code by definition (it's what being a global means, after all). Could you elaborate on how you think this might be exploited? I'll drop into the
Python chatroom in case you'd like to discuss this in more detail than comments allow. —
Zero Piraeus 1 min ago