Unsafe MessagePack Deserialization
Overview
MessagePack is generally safer than pickle/Java serialization, but certain configurations and extensions can allow type coercion or code execution when combined with object extensibility features.
Remediation
- Use
raw=Truein Python msgpack to avoid string coercion - Validate deserialized data against a schema before use
- Do not pass deserialized objects directly to code execution paths