Python Import as an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps
研究通过ImportMine分析Python导入相关漏洞和错误,结合安全公告与PyPI历史数据,识别并分类问题,提出修复方案。
研究通过ImportMine分析Python导入相关漏洞和错误,结合安全公告与PyPI历史数据,识别并分类问题,提出修复方案。
本文介绍RAGTIMER 1.0工具,通过构建部分状态空间来分析连续时间随机向量加法系统中罕见事件的概率,提供了一个保证的下界估计方法。
本文研究了大型语言模型中的记忆化问题,通过确定差分隐私(DP)常数来区分反事实记忆和自适应提取,并指出这两种方法不能互相控制。
本文使用约束贝叶斯先验和Hamiltonian Monte Carlo算法估计由年最大积雪引起的雪荷载的GEV分布参数,解决了小样本下参数估计的稳健性问题。
This study addresses a critical gap in Python software security research, which has predominantly focused on source code while overlooking the distinct risks posed by bytecode (e.g., .pyc files). We present the first large-scale empirical analysis of bytecode distribution and security across PyPI packages. Leveraging version-aware decompilation, bytecode fuzzing, anomaly clustering, and source–bytecode equivalence validation, we systematically assess threats to the CPython runtime. Among over one million PyPI artifacts, we identify 7,388 packages containing bytecode. Our analysis reveals 17 robustness flaws in decompilers and uncovers 1,009 unique crash-triggering inputs via fuzzing, 261 of which exhibit memory corruption characteristics. Notably, 91.7% of these violations breach security boundaries, and the majority cannot be reproduced from source code, demonstrating that bytecode can evade conventional detection mechanisms and expose deep interpreter vulnerabilities.
研究通过ImportMine分析Python导入相关漏洞和错误,结合安全公告与PyPI历史数据,识别并分类问题,提出修复方案。
本文介绍RAGTIMER 1.0工具,通过构建部分状态空间来分析连续时间随机向量加法系统中罕见事件的概率,提供了一个保证的下界估计方法。
本文研究了大型语言模型中的记忆化问题,通过确定差分隐私(DP)常数来区分反事实记忆和自适应提取,并指出这两种方法不能互相控制。
本文使用约束贝叶斯先验和Hamiltonian Monte Carlo算法估计由年最大积雪引起的雪荷载的GEV分布参数,解决了小样本下参数估计的稳健性问题。
This study addresses a critical gap in Python software security research, which has predominantly focused on source code while overlooking the distinct risks posed by bytecode (e.g., .pyc files). We present the first large-scale empirical analysis of bytecode distribution and security across PyPI packages. Leveraging version-aware decompilation, bytecode fuzzing, anomaly clustering, and source–bytecode equivalence validation, we systematically assess threats to the CPython runtime. Among over one million PyPI artifacts, we identify 7,388 packages containing bytecode. Our analysis reveals 17 robustness flaws in decompilers and uncovers 1,009 unique crash-triggering inputs via fuzzing, 261 of which exhibit memory corruption characteristics. Notably, 91.7% of these violations breach security boundaries, and the majority cannot be reproduced from source code, demonstrating that bytecode can evade conventional detection mechanisms and expose deep interpreter vulnerabilities.