Insecure Deserialization

YAML

The yaml.load() python function allows you to perform code execution by injecting a python object into the YAML document being processed.

!!python/object/apply:os.system ["sleep 10"]

Reference: https://www.owasp.org/index.php/Deserialization_Cheat_Sheet#Python