deserialization
Safeguard articles tagged "deserialization" — guides, analysis, and best practices for software supply chain and application security.
65 articles
The POJO Class in Java: A Security Guide to Plain Objects
A POJO class in Java looks harmless — just fields and getters — but the moment it becomes a deserialization target it turns into an attack surface. Here is how plain objects go wrong and how to keep them safe.
Advanced Python: The Security-Focused Patterns Senior Developers Should Master
Advanced Python is not about clever one-liners. The patterns that separate senior engineers are the ones that keep code safe: safe deserialization, controlled subprocess calls, and disciplined dependency use.
Log4j 1.2.17 Vulnerabilities: Why Log4j 1.x Cannot Be Fixed
The only real log4j 1.2.17 vulnerability fix is migrating off the 1.x line — it reached end of life in 2015 and its RCE-class CVEs will never be patched. Here is the case and the path.
The Most Common Java Security Flaws and How to Fix Them
A practitioner's tour of the Java security flaws that actually break production systems — deserialization, injection, XXE, and the dependency risks that scanners miss.
Pickling in Python: A Security Guide
Pickling in Python serializes objects to bytes, but unpickling untrusted data can run arbitrary code. Here is how the risk works and how to defend against it.
How to Fix the SnakeYAML Vulnerability (CVE-2022-1471)
The SnakeYAML vulnerability fix comes down to one move: get off the 1.x line and onto 2.x, where the parser stops trusting arbitrary Java types by default.
SnakeYAML in Maven: How to Use It Safely and Avoid CVE-2022-1471
Adding SnakeYAML as a Maven dependency is fine, but parsing untrusted YAML with the default constructor is not. Here is how to pin a safe version and lock down deserialization.
YAML Parsers in Java: SnakeYAML Deserialization Risks Explained
Choosing a YAML parser in Java means choosing a deserialization posture. How SnakeYAML's CVE-2022-1471 worked, what changed in 2.0, and how to parse YAML safely.
Java Vulnerability Classes: A Reference List
A java vulnerability list organized by class — deserialization, injection, XXE, and the rest — because Java's ecosystem produces a specific, recurring set of vulnerability patterns worth knowing by name.
YAML Deserialization Attacks: The Config File That Runs Code
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
YAML Deserialization Attacks and How to Prevent Them
YAML looks innocent but its deserialization features have led to remote code execution in countless applications. Here is why and how to stay safe.
Deserialization Attacks in Java and Python
Insecure deserialization turns data parsing into code execution. This guide covers deserialization attacks in Java and Python, the gadget chain concept, and practical defenses for both ecosystems.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.