domains / families / security / phy-deserialization-audit

phy-deserialization-audit

separate

Unsafe deserialization vulnerability scanner (OWASP A08:2021). Detects Python pickle/yaml/eval, Java ObjectInputStream/XStream/XMLDecoder, PHP unserialize, Ruby Marshal.load, Node.js eval/new Function/vm, Go gob with interface{}. Traces HTTP input sources to dangerous sinks, classifies CRITICAL/HIGH/MEDIUM, outputs CWE/CVE mappings and per-language fix snippets. Zero competitors on ClawHub.

When to use

• Python pickle/yaml/eval detection
• Java ObjectInputStream/XStream/XMLDecoder detection
• PHP unserialize detection
• Ruby Marshal.load detection
• Node.js eval/new Function/vm detection
• Go gob with interface{} detection
• HTTP input source tracing
• CWE/CVE mapping and fix snippets

When not to use

• Network calls
• API key usage

Skill page

Source