Insecure deserialization via ObjectInputStream.readObject

Shield rates this critical (CVSS 9.8), classified as CWE-502.

criticalKotlinCWE-502CVSS 9.8

What it detects

Calling ObjectInputStream.readObject on untrusted data can trigger remote code execution through gadget chains.

Avoid Java native deserialization of untrusted input; use a safe format like JSON with strict schemas.

Vulnerable — Shield flags thisDeser.kt

fun load(input: InputStream): Any {
    return ObjectInputStream(input).readObject()
}

Fixed — scans cleanDeser.kt

fun load(input: InputStream): UserProfile {
    val text = input.reader().readText()
    return Json.decodeFromString<UserProfile>(text)
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-KOTLIN-007, the fixed one does not.