Deserialization of Untrusted Data
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-502: Deserialization of Untrusted Data |
| OWASP | A08:2017 - Insecure Deserialization |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
Using Python’s marshal module to load or unmarshal data from untrusted sources is unsafe, as it does not validate or secure the input. Attackers can craft malicious data that, when unmarshaled, can corrupt the program or execute arbitrary code.
Impact#
If exploited, this vulnerability could let attackers execute arbitrary Python code, compromise sensitive data, or disrupt application logic, leading to a full system compromise or data breach. Applications processing untrusted input with marshal are especially at risk.