Security vulnerability fixed

[briantoby]

A long-term security vulnerability in GSAS-II was fixed as of GSAS-II version v5.10.0 (we are now at v5.10.2, #5847). I am recommending that if you are using v5.9 or earlier, you update immediately, but if you are unable to do that, please only open GSAS-II project (.gpx) files that you have created or that you received from people you trust.

For a bit more about the vulnerability: from the beginning versions, GSAS-II has used a Python mechanism called a pickle to save complex data structures in our .gpx files. It is possible to put executable code into a pickle, so a very experienced Python programmer could modify a .gpx file in such a way that if transmitted to another person and opened in GSAS-II, it would execute Python code that is not part of GSAS-II on that person’s computer. This has never happened, as far as we are aware. 

   Dilanka Kaushal Hewage (GitHub: r3vpwnx), an expert on computer security, was conducting a review of desktop science applications and reported this security problem to us on GitHub on Wednesday evening 10/28/26, along with suggestions on how it could be addressed -- with capabilities I was not aware existed. Over the next few days, he was of great help to me as I made updates to close this security hole and he reviewed the code changes and tested the final revised version. The revised code restricts what will be read from the pickle files used in GSAS-II to specific and expected objects and none of them will allow for code insertion. For someone who has no connection to the GSAS-II user community, this was a particularly generous use of his time and Dilanka is due a lot of gratitude.

   I tested the revised code on ~2000 .gpx files that I have on my computer and the small number that could not be read were all >>5 years old and none could read by GSAS-II before this change. However, Python pickles are used in a number of places in GSAS-II (for example with phase-partials, where the intensity from each phase is stored separately, or for the undo operation in peak fitting.) Bob and I have tested what we could, but it is possible that this fix could break some operations within GSAS-II that have not been tested, so we ask that if you find an operation that used to work, but no longer does, please report it to me, Bob or create an issue on the GitHub repo so it can be fixed.