Deserializing untrusted data using any deserialization framework that allows the construction of arbitrary functions is easily exploitable and, in many cases, allows an attacker to execute arbitrary code.
Avoid deserialization of untrusted data if at all possible. If the architecture permits it, then use formats like JSON or XML that cannot represent functions. When using YAML or other formats that support the serialization and deserialization of functions, ensure that the parser is configured to disable deserialization of arbitrary functions.
The following example calls the load function of the popular
js-yaml package on data that comes from an HTTP request and
hence is inherently unsafe.
Using the safeLoad function instead (which does not deserialize
YAML-encoded functions) removes the vulnerability.