A08:2025 — Software or Data Integrity Failures

Overview

OWASP rank: #8 (2025) | CWEs covered: 14 | Avg incidence: 2.75%

This category focuses on failure to verify integrity of software, code, and data artifacts within your own environment — distinct from A03's upstream supply chain focus. The core concern is: can you trust what you're loading, deserializing, or executing?

Key distinction from A03 (Supply Chain):

• A03 = upstream integrity (your dependencies, CI/CD pipelines)
• A08 = runtime integrity (what you actually deserialize, include, or auto-update at runtime)

Critical Risk Areas for Python

1. Insecure Deserialization — The #1 Python-Specific Risk

pickle.loads() on untrusted input equals arbitrary code execution via __reduce__. This is the single most dangerous A08 vector in Python.