deserialization
3 articles with this tag
CVE-2026-126187 — Unauthenticated remote code execution in React Server Components (react-server-dom-* fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1): explainer and fix
A deserialization of untrusted data flaw (CWE-502) in React's Server Components packages (react-server-dom-webpack, -parcel and -turbopack). GitHub's advisory says crafted payloads can lead to unauthenticated remote code execution, with a CVSS v4 score of 9.5 (Critical). The advisory also says it only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. The fixed versions were released on 14 October 2026 and the advisory was published on 10 November. No exploitation is reported. This site's view: the score is high, so any app using Server Components should check the react-server-dom-* versions it depends on and move to a fixed version.
Insecure deserialization: the risk of letting external data choose the object type, and how to prevent it
The danger in deserialization is not that bad values arrive; it is that some formats let external data decide which type of object to construct. So the damage does not stop at corrupted data — OWASP lists denial of service, access control bypass and remote code execution. Two defenses: switch to a pure data format so nothing chooses types for you, and sign serialized messages so unsigned ones are never restored. And some mechanisms cannot be made safe by configuration at all; the only fix is not using them.
CVE-2026-45247 — unauthenticated RCE in a Magento extension via PHP object injection
PHP object injection (CWE-502) in Mirasvit Full Page Cache Warmer for Magento 2 before 1.11.12 reaches unauthenticated RCE. CVSS 9.3. The main fix is updating to 1.11.12+. The root rule: never deserialize untrusted data.