Deserialization of Untrusted Data
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-502: Deserialization of Untrusted Data |
| OWASP | A08:2017 - Insecure Deserialization |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
The code uses insecure deserialization libraries (like pickle or yaml.load) within a Flask route, which can allow attackers to execute arbitrary code if untrusted user input is deserialized. Avoid passing user data to these functions and use safer alternatives like JSON for serialization.
Impact#
If exploited, an attacker could run malicious code on your server, leading to data theft, server compromise, or full control over the application. This can result in data breaches, service disruption, or further attacks on your organization’s infrastructure.