From 019b0ed7a7df50ade6fbe66bf6437259a56ddbd5 Mon Sep 17 00:00:00 2001
From: RinZ27 <222222878+RinZ27@users.noreply.github.com>
Date: Wed, 11 Mar 2026 22:37:44 +0700
Subject: [PATCH] Fix RCE vulnerability in ik_utils by replacing pickle with
 json

---
 robosuite/utils/ik_utils.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/robosuite/utils/ik_utils.py b/robosuite/utils/ik_utils.py
index 0f08abb6f4..b65ee5fb8b 100644
--- a/robosuite/utils/ik_utils.py
+++ b/robosuite/utils/ik_utils.py
@@ -83,10 +83,10 @@ def __init__(
         elif input_type == "pkl":
             self.mocap_ids = [self.full_model.body(name).mocapid[0] for name in robot_config["mocap_bodies"]]
             self.pkl_t = 0
-            import pickle
+            import json
 
-            with open(input_file, "rb") as f:
-                input_file = pickle.load(f)
+            with open(input_file, "r") as f:
+                input_file = json.load(f)
             self.history = input_file
 
         # Nullspace control