> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Tainted dill pyramid

> **tainted-dill-pyramid**
>
> The application may convert user-controlled data into an object, which can lead to an insecure deserialization vulnerability. An attacker can create a malicious serialized object, pass it to the application, and take advantage of the deserialization process to perform Denial-of-service (DoS), Remote code execution (RCE), or bypass access control measures. To prevent this vulnerability, leverage data formats such as JSON or XML as safer alternatives. If you need to deserialize user input in a specific format, consider digitally signing the data before serialization to prevent tampering. For more information, see: [Deserialization prevention](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) The `dill` module allows arbitrary user defined classes and functions to be serialized. We do not recommend using it for unpickling data from untrusted sources. For deserializing data from untrusted sources we recommend using YAML or JSON libraries with built-in protections.\
> **Likelihood**: MEDIUM\
> **Confidence**: HIGH\
> **CWE**: \
> \- CWE-502: Deserialization of Untrusted Data
> \
> **OWASP**: \
> \- A08:2017 - Insecure Deserialization
> \
> \- A08:2021 - Software and Data Integrity Failures


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.