Posted by Ron E on Aug 26Chronicle Wire permits YAML type tags supplied within serialized input to influence Java class selection and object instantiation during untyped deserialization. When applications deserialize attacker-controlled or otherwise untrusted YAML through APIs such as readObject() or object(Object.class), an externally controlled YAML type tag can identify a Java class that Chronicle Wire resolves through its configured ClassLookup. When the default...