Deserialization of Untrusted Data
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-502: Deserialization of Untrusted Data |
| OWASP | A08:2017 - Insecure Deserialization |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
The code uses insecure deserialization functions like pickle, cPickle, dill, shelve, or unsafe yaml loaders to process data that may come from user input. These libraries can execute arbitrary code during deserialization, making it unsafe to use them with untrusted data.
Impact#
If exploited, an attacker could craft malicious input that, when deserialized, runs arbitrary code on the server. This could lead to full system compromise, data theft, or service disruption, severely impacting the application’s security and reliability.