| name | detecting-insecure-deserialization |
| description | Scan a source tree for unsafe-by-default deserialization APIs:
Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load /
YAML.load (pre-3.1 default), Java ObjectInputStream.readObject,
PHP unserialize, .NET BinaryFormatter / NetDataContractSerializer,
Node.js node-serialize, JavaScript JSON.parse with reviver
containing eval.
Use when: pre-commit gate on services that accept binary blobs,
audit of legacy job-queue code (workers deserializing tasks),
post-bug-report when "we accept user-uploaded archives."
Threshold: any call to a known-unsafe deserialization API on
data that originates from user input, network, file upload,
or untrusted storage.
Trigger with: "scan deserialization", "pickle audit", "java
readObject scan", "yaml.load check".
|
| allowed-tools | ["Read","Bash(python3:*)","Glob","Grep"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","static-analysis","deserialization","pentest"] |
Detecting Insecure Deserialization
Overview
Insecure deserialization (CWE-502, OWASP A08:2021) is the highest-
severity injection class in many language stacks because it directly
maps to RCE. Pickle, Java serialization, PHP unserialize, and
BinaryFormatter all execute object-construction code during
deserialization. If that code includes __reduce__ /
readObject / __wakeup / OnDeserialization callbacks that
the attacker controls, the deserialization step IS code execution.
Most legitimate use cases have safer alternatives (JSON for data,
YAML with safe-load, Protocol Buffers, Avro). The remaining cases
need explicit type allow-lists and HMAC-signed payloads.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
Python pickle.loads(...) | CRITICAL | always (untrusted input) | CWE-502 |
Python pickle.load(file) | CRITICAL | always | CWE-502 |
Python dill.loads | CRITICAL | always | CWE-502 |
Python yaml.load(...) without Loader= | CRITICAL | unsafe legacy default | CWE-502 |
Python yaml.unsafe_load(...) | CRITICAL | explicit unsafe | CWE-502 |
Python shelve.open(...) | HIGH | pickle-backed; user-controllable filename | CWE-502 |
Java ObjectInputStream.readObject() | CRITICAL | always | CWE-502 |
PHP unserialize($input) | CRITICAL | non-literal input | CWE-502 |
.NET BinaryFormatter.Deserialize(...) | CRITICAL | deprecated unsafe API | CWE-502 |
| .NET |
