Deserialization

Unsafe deserialization and data integrity vulnerabilities

1
Security Rules

Run All Deserialization Rules

pathfinder scan --ruleset cpf/python/deserialization

Rules

Unsafe Pickle Deserialization

CRITICAL

Unsafe pickle deserialization: Untrusted data flows to pickle.loads() which can execute arbitrary code. Use json.loads() instead.

pythondeserializationpicklerceuntrusted-dataowasp-a08cwe-502remote-code-executioncriticalsecurityintra-procedural
CWE-502
CVE-2021-3177
Updated 2026-01-17
Back to Python CategoriesAll Languages →