Chronicle Wire v2026.8 Arbitrary Class Instantiation During YAML Deserialization via Externally Controlled YAML Type Tags

<p>Posted by Ron E on Aug 26</p>Chronicle Wire permits YAML type tags supplied within serialized input to<br /> influence Java class selection and object instantiation during untyped<br /> deserialization.<br /> <br /> When applications deserialize attacker-controlled or otherwise untrusted<br /> YAML through APIs such as readObject() or object(Object.class), an<br /> externally controlled YAML ty