Deserializing untrusted data with pickle can lead to arbitrary code execution.
Use JSON or another safe serialization format instead of pickle for untrusted data.