Deserialization attack
When reading "data" from an untrusted source executes arbitrary code — Java serialization, Python pickle, PHP unserialize.
Java and PHP are notorious. Pickle: "never unpickle data received from an untrusted source" (Python docs). Solution: JSON or signed formats. safetensors for ML models solves the same problem.