Weakness (CWE)
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
How to prevent it (7 mitigations)
-
Architecture and Design, Implementation
If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
-
Implementation
When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.
-
Implementation
Explicitly define a final object() to prevent deserialization.
-
Architecture and Design, Implementation
Make fields transient to protect them from deserialization.
An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.
-
Implementation
Avoid having unnecessary types or gadgets (a sequence of instances and method invocations that can self-execute during the deserialization process, often found in libraries) available that can be leveraged for malicious ends. This limits the potential for unintended or unauthorized types and gadgets to be leveraged by the attacker. Add only acceptable classes to an allowlist. Note: new gadgets are constantly being discovered, so this alone is not a sufficient mitigation.
-
Architecture and Design, Implementation
Employ cryptography of the data or code for protection. However, it's important to note that it would still be client-side security. This is risky because if the client is compromised then the security implemented on the client (the cryptography) can be bypassed.
-
Operation
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
Source: MITRE CWE-502
3,347 results · Feed
-
High 7.8
Insecure Deserialization in SAP NetWeaver Business Client
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the a…
-
Critical 9.8
Code Injection in Next4Biz's CSM (Customer Service Management)
Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Injection. This issue affects CSM (Customer Service Management): before 8.0.3.
-
High 8.8
Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default
EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by defau…
-
Critical 9.8CVE-2026-10196 Public exploit
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' f…
-
High 8.8
Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback
The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deserialization of untrusted input in the Telecom EDY payment callback (usces_action_acting_transaction). Unauthenticated attack…
-
Critical 9.4
YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
-
High 7.5
SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authent…
-
Medium 6.2
Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the available stack space.
Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious QPY payload can trigger a segmentation fault, causing the application to crash when deserializing untrusted input.
-
Critical 9.8
WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in JobSearch <= 3.2.0 versions.
-
Critical 9.8CVE-2026-84753 Public exploit
WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
-
High 8.8
WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability
Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.
-
High 8.6
Unsafe deserialization in the REST interface
SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges.
-
High 8.8
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when…
-
High 8.8
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowi…
-
High 8.8
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS…
-
Medium 4.3
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserial…
-
Low 3.3
Weaver Show Posts < 1.8.1 - Admin+ PHP Object Injection
The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.
-
High 8.8
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.
-
High 8.8
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions.
-
High 8.8
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post is reopened in its frontend editing form, allowing authenticated users with subscriber-level access and above to perform…
-
High 8.8CVE-2026-71981 Public exploit
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can p…
-
High 8.8
Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a …
-
High 8.8
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
## Summary MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to `False`, operators expect all pickle des…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…
-
High 7.8
NVIDIA Megatron Bridge contains a vulnerability where an attacker could cause a deserialization of untrusted data. A su…