deserialization
Safeguard articles tagged "deserialization" — guides, analysis, and best practices for software supply chain and application security.
65 articles
CVE-2017-18342: Arbitrary code execution via PyYAML yaml....
CVE-2017-18342 lets attackers achieve remote code execution via PyYAML's yaml.load(), which deserialized untrusted YAML into live Python objects by default.
CVE-2020-14343: PyYAML arbitrary code execution via pytho...
CVE-2020-14343 lets attackers run arbitrary code via PyYAML's python/object/new tag, bypassing an earlier FullLoader fix. Versions, CVSS, and remediation inside.
CVE-2015-6420: Deserialization vulnerability via Apache C...
How a vulnerable Apache Commons Collections library let attackers achieve remote code execution via Java deserialization gadget chains, and what CVE-2015-6420 still teaches about supply chain risk.
CVE-2019-14540: Jackson-databind blacklist bypass via c3p...
CVE-2019-14540 lets attackers bypass jackson-databind's deserialization blacklist via c3p0 classes to achieve RCE. Here's what's affected, the timeline, and how to remediate.
CVE-2021-25329: Incomplete fix of Tomcat PersistenceManag...
CVE-2021-25329 shows how Tomcat's PersistenceManager deserialization fix (CVE-2020-9484) was incomplete, still risking RCE in edge-case configs.
CVE-2022-1471: Remote code execution in SnakeYAML deseria...
CVE-2022-1471 exposes SnakeYAML deserialization to remote code execution. Here is what is affected, CVSS context, and how to remediate the flaw.
YAML Code Security: Deserialization, Injection, and Safe Parsing
YAML code powers config files across the ecosystem, but unsafe parsing can turn a data file into remote code execution. Here is how to write and load it safely.
Python Pickle: Reading, Writing, and Why It Is a Security Risk
How to pickle an object in Python and read a pickle file back, and the reason the standard library itself warns you never to unpickle data you did not produce.
Apache Tomcat CVE-2025-24813: a deserialization deep dive
Tomcat's partial-PUT deserialization RCE turned a session persistence feature into a remote code execution path, and the pattern is one Java middleware keeps repeating.
npm js-yaml: A Security Review and Safe Usage Guide
npm js-yaml is the standard YAML parser for Node.js. Its history includes real code-execution bugs, and how you call it still decides whether your app is safe.
Python Pickle Load: A Security Guide
Calling python pickle load on data you do not fully control can execute arbitrary code. Here is why, and what to use instead.
Python pickle.dump Explained, and Why It Can Get You Popped
How Python's pickle.dump actually works, a runnable example, and the deserialization risk that turns a saved object into remote code execution.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.