> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tainted jsonpickle aws lambda

> **tainted-jsonpickle-aws-lambda**
>
> The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. The `jsonpickle` module can execute arbitrary Python code. Do not load `jsonpickles` from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections, such as json, PyYAML, or ruamel.yaml.\
> **Likelihood**: MEDIUM\
> **Confidence**: HIGH\
> **CWE**: \
> \- CWE-502: Deserialization of Untrusted Data
> \
> **OWASP**: \
> \- A08:2017 - Insecure Deserialization
> \
> \- A08:2021 - Software and Data Integrity Failures


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.