SG-038: Unsafe Deserialization

Severity: HIGH

pickle.load / yaml.load / marshal / unserialize

Fires when

• Python pickle.load / pickle.loads is called
• yaml.load is called without a SafeLoader
• marshal, cloudpickle, or jsonpickle deserialization is used
• PHP unserialize() or Java ObjectInputStream is used

Remediation

No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.