Check Module DESER — Deserialization & Object Injection

Scope & Objectives

Find every place where untrusted data (network input, message queues, files, cookies, cache entries) is converted back into executable objects or rich data structures, and determine whether an attacker can abuse that conversion to:

1. Execute code (native deserialization gadget chains),
2. Read files or reach internal services (XXE),
3. Alter application logic without code execution (prototype pollution, object injection, type confusion).

Covered here: native object serialization (pickle, Java, .NET, PHP, Ruby), XML parsing incl. external entities (XXE), YAML loading, and server-side JavaScript prototype pollution. Out of scope (cross-referenced): mass assignment (API), SSRF from URL fetchers (SSRF), decompression/entity-bomb resource math (DOS), JWT/token integrity (AUTHN).