Deserialization

Unsafe deserialization and data integrity vulnerabilities

1
Security Rules

Run All Deserialization Rules

pathfinder scan --ruleset python/deserialization --project .

Rules

Unsafe Pickle Deserialization

CRITICAL

Unsafe pickle deserialization: Untrusted data flows to pickle.loads() which can execute arbitrary code. Use json.loads() instead.

pythondeserializationpicklerceuntrusted-dataowasp-a08cwe-502remote-code-executioncriticalsecurityintra-procedural
CWE-502
CVE-2021-3177
Updated 2026-03-22

Other Python Categories

AWS Lambda

14 rules

Cryptography

23 rules

Django

23 rules

Flask

21 rules

JWT

5 rules

Python Core

54 rules

Pyramid

2 rules

Back to Python CategoriesAll Languages →