Insecure Deserialization

Insecure deserialization occurs when an application reconstructs objects from untrusted data — typically a serialized stream from a cookie, cache, or network endpoint — without verifying the integrity or type of the data. In languages with rich object graphs (Java, PHP, Python pickle, Ruby Marshal, Node.js node-serialize), an attacker can craft a payload that triggers dangerous method calls during deserialization itself.

This class is difficult to spot in review because the dangerous operation is the deserialization call, which looks identical to safe calls from trusted sources. Reviewers must trace where the serialized data comes from and whether an attacker can control it — a data-flow question that is hard to answer just by looking at the deserialize() call site.

PullLight flags deserialization calls on data sourced from HTTP requests, databases loaded by user-controlled IDs, and external APIs, and it recognizes PHP unserialize(), Java ObjectInputStream, Python pickle.loads(), and Node.js node-serialize as high-risk sinks. The Roundcube RCE (CVE-2025-49113) is a recent example where a PHP parameter reached unserialize().