Application Security
YAML Deserialization Attacks: The Config File That Runs Code
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
Feb 18, 20264 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
YAML's type system allows object instantiation during parsing. In many languages, this means a YAML file can execute arbitrary code.
YAML looks innocent but its deserialization features have led to remote code execution in countless applications. Here is why and how to stay safe.
Insecure deserialization turns data parsing into code execution. This guide covers deserialization attacks in Java and Python, the gadget chain concept, and practical defenses for both ecosystems.
Weekly insights on software supply chain security, delivered to your inbox.