Небезпечна десеріалізація

Insecure Deserialization occurs when untrusted data is deserialised without validation, potentially leading to RCE, privilege escalation, or DoS.

Common in Java (gadget chains), Python (pickle), PHP (unserialize).

Mitigation

Integrity checks (HMAC), use safe formats (JSON), sandbox the deserialisation process.