It's possiblt to execute code thorugh object pickles.
vulners.com/securityvulns/securityvulns:doc:9755