An insecure deserialization issue exists in the `load session()` function. An attacker can execute arbitrary Python code by tricking a user into loading a specially crafted `.pkl.gz` pickle session file via the `-s` option or `conf.session` variable. The execution occurs through the ` reduce ()` method during the deserialization process.