no-unsafe-deserialization

CWE: CWE-693
OWASP Mobile: OWASP Mobile Top 10

Detects unsafe deserialization of untrusted data. This rule is part of eslint-plugin-secure-coding.

💼 This rule is set to error in the recommended config.

Quick Summary

Value & investment case

Why this rule pays for itself. Framework: cicd-impact/philosophy.md.

Read also: philosophy.md §investor-frame · niche-presets.json · analyzer-evaluation-framework.md

Vulnerability and Risk

Vulnerability: Unsafe deserialization happens when an application accepts serialized objects from untrusted sources and deserializes them without validation.

Risk: Serialized data can contain malicious payloads that, upon deserialization, execute arbitrary code (Remote Code Execution - RCE), modify application logic, or cause Denial of Service (DoS). This is often considered one of the most critical security risks.

Rule Details

Unsafe deserialization occurs when untrusted data is deserialized in a way that allows attackers to execute arbitrary code or manipulate application logic. This includes:

• Using eval() or Function() on untrusted data
• YAML parsers that execute code
• JSON with prototype pollution
• Insecure serialization libraries

What is NOT reported

Two exclusions were added in 2026-07 after a 1,470-file corpus run (webpack, lodash, eslint-plugin-import, two NestJS boilerplates) produced 35 findings, all of them false, all at CVSS 9.8 CRITICAL:

• setTimeout / setInterval with a non-string first argument. These are a code-execution sink only in their implied-eval form. setTimeout(cb, 1000) is a scheduler. The rule previously reported await new Promise(resolve => setTimeout(resolve, 1000)) — an ordinary sleep — because setTimeout is on the dangerous-function list and resolve is an enclosing arrow-function parameter. setTimeout("alert(" + userCode + ")", 100) still reports.
• Calls inside a deserializer implementation. super.deserialize(context), this.deserialize(context), and any x.deserialize(…) sitting inside a function named deserialize / unserialize / fromJSON / fromBuffer. That is a class implementing a (de)serialization protocol and chaining to the next layer of it — webpack's static deserialize(context) factories account for 33 of the 35 findings. A rule that cannot see the protocol cannot judge it.

Why This Matters

Examples

❌ Incorrect

const func = new Function(req.body.input);

✅ Correct

// Use JSON.parse() for JSON data
const data = JSON.parse(userInput);

// YAML with safeLoad
import yaml from 'js-yaml';
const config = yaml.safeLoad(userYaml);
// Or with explicit safe schema
const config = yaml.load(userYaml, { schema: yaml.SAFE_SCHEMA });

// Validate before deserialization
if (isValidJson(userInput)) {
  const data = JSON.parse(userInput);
}

// Use safe serialization libraries
import { safeDeserialize } from 'safe-serialize';
const obj = safeDeserialize(userInput);

Configuration

{
  rules: {
    'secure-coding/no-unsafe-deserialization': ['error', {
      dangerousFunctions: ['eval', 'Function', 'serialize.unserialize'],
      safeLibraries: ['safe-serialize', 'json5'],
      validationFunctions: ['isValidJson', 'validateInput']
    }]
  }
}

Options

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-502 OWASP:A08 CVSS:9.8 | Deserialization of Untrusted Data detected | CRITICAL
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A08_2021/

Message Components

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Values from Variables

Why: Values stored in variables are not traced.

// ❌ NOT DETECTED - Value from variable
const value = userInput;
dangerousOperation(value);

Mitigation: Validate all user inputs.

Wrapper Functions

Why: Custom wrappers not recognized.

// ❌ NOT DETECTED - Wrapper
myWrapper(userInput); // Uses dangerous API internally

Mitigation: Apply rule to wrapper implementations.

Dynamic Invocation

Why: Dynamic calls not analyzed.

// ❌ NOT DETECTED - Dynamic
obj[method](userInput);

Mitigation: Avoid dynamic method invocation.

Further Reading

• OWASP Deserialization - Testing guide
• CWE-502 - Official CWE entry
• js-yaml Security - YAML security

Related Rules

• detect-eval-with-expression - eval() injection
• detect-object-injection - Prototype pollution