A8: Insecure Deserialization · 2017

Untrusted serialized objects can alter logic, execute code or abuse dangerous types during object reconstruction.

Summary

Untrusted serialized objects can alter logic, execute code or abuse dangerous types during object reconstruction.

How the attack works

An untrusted cookie is reconstructed as a native object; deserialization may trigger behavior before the object is validated.

Example

Vulnerable · Pseudocode

blob = request.cookies["state"]
state = pickle.loads(decode(blob))

Fix: Use schema-validated JSON and validate values; avoid native objects from untrusted sources.

Prevention

Avoid deserializing native objects from untrusted sources.
Use simple formats with schemas and type allowlists.
Verify integrity and isolate serialized data processing.

Lineage

2017 · A8: Insecure Deserialization Expanded into a new category
2021 · A08: Software and Data Integrity Failures New and expanded from Insecure Deserialization
2025 · A08: Software or Data Integrity Failures Continues at rank 8

2017:A8 → 2021:A08: Insecure Deserialization becomes a broader integrity category.
2021:A08 → 2025:A08: The category continues at rank 8 with a minor name adjustment.

Sources

Open official source ↗

Buy me a coffee