Unsafe deserialization in a scientific-analysis project
The key takeaway is architectural: serialization formats that can revive executable behavior should not be an interchange boundary for untrusted artifacts.
Editorial decision card. This page links to a source-verified public disclosure and contains only original defensive analysis. It does not mirror upstream HTML, payloads, attachments, private submissions, or exploit steps.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- GSFC HPLC Precision Analysis
- Weakness
- Insecure deserialization · CWE-502
- Affected boundary
- Cached analysis artifact processing
- Disclosure date
- 2026-05-29
- Public status checked
- 2026-09-10
- Public attribution
- kernely
What the evidence established
The public source attributes the condition to deserializing untrusted data and states that the risky format was replaced.
Why the impact was credible
The source reported code-execution risk in the analysis environment through unsafe object deserialization.
Durable engineering lesson
The key takeaway is architectural: serialization formats that can revive executable behavior should not be an interchange boundary for untrusted artifacts.
Control pattern
Avoid deserializing untrusted native objects; use data-only formats with schema validation and explicit integrity controls.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.