Comment

Marius Gedminas

By the way, the same security warning applies to Pickle/cPickle: if you can supply arbitrary input, you can execute arbitrary code.

Marshal is also unsafe for long-term data storage: the format is intentionally undocumented and may change between Python versions.