ANT-2026-PGRNAV88: spark rce

UserDefinedType.fromJson() in python/pyspark/sql/types.py:2002 passes bytes taken from Parquet file metadata directly to cloudpickle.loads() with no validation. An attacker who can supply a crafted Parquet file to a PySpark consumer achieves arbitrary code execution in the reading process. No explicit .schema call is required — DataFrame.repr triggers the path automatically, so simply loading and displaying the file in the PySpark REPL or a Jupyter notebook is sufficient. This is the same class as CVE-2025-30065 (CVSS 10.0) but more direct, as it grants unrestricted pickle execution without needing any gadget chain.

Target

Project: Spark
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The root cause is an unguarded call to cloudpickle.loads() on bytes sourced from untrusted Parquet metadata inside UserDefinedType.fromJson(). Because pickle deserialization is equivalent to code execution, any attacker who controls the Parquet file controls what runs in the PySpark process.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-PGRNAV88.

---

Reference: ANT-2026-PGRNAV88
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

{
  "ant_id": "ANT-2026-PGRNAV88",
  "bug_class": null,
  "claude_severity": "critical",
  "commit_sha": null,
  "created_at": "2026-03-29T20:43:37+00:00",
  "description": "UserDefinedType.fromJson() in python/pyspark/sql/types.py:2002 passes bytes taken from Parquet file metadata directly to cloudpickle.loads() with no validation. An attacker who can supply a crafted Parquet file to a PySpark consumer achieves arbitrary code execution in the reading process. No explicit .schema call is required — DataFrame.__repr__ triggers the path automatically, so simply loading and displaying the file in the PySpark REPL or a Jupyter notebook is sufficient. This is the same class as CVE-2025-30065 (CVSS 10.0) but more direct, as it grants unrestricted pickle execution without needing any gadget chain.",
  "discovered_at": "2026-02-22T00:00:00+00:00",
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "Spark",
  "reproduction": null,
  "technical_details": "The root cause is an unguarded call to cloudpickle.loads() on bytes sourced from untrusted Parquet metadata inside UserDefinedType.fromJson(). Because pickle deserialization is equivalent to code execution, any attacker who controls the Parquet file controls what runs in the PySpark process.",
  "title": "spark rce",
  "vendor_severity": null
}