Why Untrusted Deserialization Can Become RCE

Untrusted deserialization is one of the shortest paths from a network byte stream to process execution. The laboratory studies the flow, not a cookbook of gadgets.

Public 2026 advisories on AI inference stacks — including reports of Python pickle accepted on network-facing paths — are treated as examples of this class. We do not reconstruct those issues here. We explain why the class exists and how a researcher should document it.

The vulnerability is construction of application objects from bytes the caller controls, using a format that can encode behavior (pickle, some Java serialization features, YAML with arbitrary object types, and similar).

If the format can only express inert data and the implementation cannot instantiate unexpected types, you do not have this class. Do not force the label.

Any service that decodes a rich object format from HTTP, RPC, message queues, job payloads, cache entries, or model artifacts. In 2026 this increasingly includes inference frameworks, agent runtimes, and plugin loaders — not only classic application servers.

The surface is every entry point that calls the deserializer before it has proven the bytes are trusted. “Trusted” means produced by your own process or by a principal that is already equivalent to code execution. A session cookie is not that. An unauthenticated POST body is not that. A model file from the internet is not that unless you treat model load as code load — and then you should say so.

The failed assumption is “this stream is data.” In these formats the stream is a construction plan. The root cause is allowing a construction plan from across a trust boundary.

This is the spine of the RCE series. Every later note should be able to fill each box with a concrete function name from a public codebase — after validation.

It becomes RCE when three facts are true at once: the input is attacker-controlled, the deserializer can instantiate types that perform work at construction or reduction time, and those types are available on the classpath or in the Python environment.

Remove any one fact and you usually have a crash, a parse error, or a confined data bug. Research is stating which facts hold — not listing gadgets for others to reuse.

Fixes in this class typically remove the unsafe decoder, restrict allowed types, require a signature on the blob, or move the endpoint behind stronger authentication. Read which of those the vendor chose. Type allowlists that still include powerful types are incomplete fixes.

If a patch only “documents that pickle is unsafe,” the invariant is not yet enforced in code.

Inventory calls to unsafe decoders on request, RPC, and queue paths. Flag model-load and checkpoint-load that accept the same formats. In review, treat “deserialize then dispatch” as a high-priority data-flow, not a style comment.

Do not deserialize untrusted data with a format that can encode behavior. Prefer inert encodings (JSON with explicit schemas, length-limited protobuf without dynamic types). Isolate remaining decoders off the network. Sign and pin artifacts you must load.

Authentication does not turn a code-loading decoder into a data parser. It only shrinks who can reach it.

RCE research that publishes a payload teaches attackers. RCE research that publishes a data-flow, an invariant, and a patch-reading method teaches operators and other researchers. This laboratory chooses the second.

OWASP, Deserialization of Untrusted Data — class definition and defensive guidance.

OWASP Deserialization Cheat Sheet — mitigation patterns (allowlists, inert formats).

Public 2026 advisories on inference-framework object decoding — cited in later CVE notes only after the official record is public.

Art of Vector Security disclosure policy — /about/responsible-disclosure.