# Insecure JSON Deserialization with Type Polymorphism

> Detects JSON deserialization configurations that allow polymorphic type instantiation, enabling object injection attacks.

- Skill: `zakirkun/insecure-json-deserialization-with-type-polymorphism` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/insecure-json-deserialization-with-type-polymorphism`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/insecure-json-deserialization-with-type-polymorphism/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/insecure-json-deserialization-with-type-polymorphism

---


# Insecure JSON Deserialization

## Overview
While JSON itself does not execute code, certain JSON library configurations allow attackers to instantiate arbitrary classes through type metadata embedded in JSON. The most notable example is Jackson's `enableDefaultTyping()` which was responsible for multiple critical CVEs.

## Remediation
- Jackson: Never use `enableDefaultTyping()`, use `@JsonTypeInfo` with explicit subtypes
- Newtonsoft.Json: Avoid `TypeNameHandling.All`
- Validate and whitelist expected types before deserialization