Unsafe Object Spread from User Input
About A08:2021 — Software & Data Integrity
Integrity failures happen when an app trusts data or code it shouldn't — running unsigned updates, deserializing untrusted JSON into native objects, pulling code from a CDN without subresource integrity. The SolarWinds breach was a software-integrity failure on a national scale.
Impact: Insecure deserialization can mean remote code execution: the attacker sends a crafted payload that, when deserialized, instantiates dangerous classes or triggers method calls. Missing subresource integrity means a CDN compromise becomes your compromise.
How to fix it: Don't deserialize untrusted input into native objects — use plain JSON parsing and validate the shape. Add subresource integrity hashes to third-party scripts. Sign software updates and verify signatures before applying. Prefer signed-commits and pinned versions in dependency management.
Common patterns in this category:
- `JSON.parse` followed by direct property access without schema validation
- Native deserialization (e.g. node-serialize, pickle) on user input
- `<script src="https://cdn...">` without `integrity=` attribute
- Auto-update mechanisms that don't verify package signatures
- CI/CD pipelines that pull from un-pinned tags
Framework mapping
Findings from this rule map to the following framework controls. This is an informational mapping, not an audit, certification, or attestation.
See the full compliance coverage page for how every rule maps to OWASP Top 10 and CWE, and which rules also carry informational SOC 2 and ISO 27001 cross-references.
VC092 is part of the full 223-rule set on paid plans (from $19/mo)
The free, no-signup scan (paste code, upload a file, or npx xploitscan@latest scan .) runs 30 core rules.