Object deserialization from an untrusted source can lead to unexpected code execution. Deserialization takes a stream of bits and turns it into an object. If the stream contains the type of object you expect, all is well. But if you're deserializing untrusted input, and an attacker has inserted some other type of object, you're in trouble. Why? There are a few different attack scenarios, but a widely-documented one goes like this: untrusted YAML content is deserialized using the unsafe ``++load++`` function form PyYAML library. ``++PyYAML.load++`` function could be easily exploited to call any Python function including system command.
