Web Vulnerabilities
Deserialization
Also: unsafe deserialization, CWE-502, object deserialization
Rebuilding a program's objects from stored or transmitted bytes; unsafe when the bytes come from an untrusted source.
In more detail
Serialization turns objects into bytes so they can be saved or sent. Some formats, such as Python pickle and Java native serialization, can describe behavior to run while rebuilding the object, so loading attacker-supplied bytes can run attacker-chosen code. Use data-only formats such as JSON and validate the result.