vetkit.kotlin.deserialization.object-input-stream

Java native deserialization (ObjectInputStream/XMLDecoder) of untrusted data can lead to remote code execution.

Last updated: 2026-11-01

Suite: Security

kotlin

Java native deserialization (ObjectInputStream/XMLDecoder) of untrusted data can lead to remote code execution.

Category: SECURITY · Engine rule severity: ERROR

How to fix it

Use a data format such as JSON (kotlinx.serialization) with explicit types, or install an ObjectInputFilter allow-list.

References

https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html

Source: packages/engine/rules/sast/kotlin.yml.

Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.