---
name: validate-unsafe-deserialization
description: Evidence bar for unsafe object deserialisation and gadget invocation. Use when validating a finding that claims attacker-controlled serialised objects are instantiated.
---

# Validate unsafe deserialisation

- Identify the serialiser and affected runtime from the evidence. A parser error, stack trace or class name alone does not prove object instantiation or impact.
- Require a target-observed effect that supports the claimed object construction or gadget invocation, and distinguish that effect from unproven downstream impact.
- Describe authentication, object-filter and runtime restrictions only where they affect the claim and are supported by the evidence.