# Deserialization reaching eval sinks

Untrusted bytes unserialized into objects or memory that reach eval, Function(), or module_eval

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $20,000; latest 2026-04-24. Updated 2026-10-27._

## How it works
A deserializer rebuilds objects or references from untrusted bytes, and the code assumes the result is inert data. That assumption breaks in two ways. In ordinary object graphs, a rebuilt object can impersonate an internal type or invoke a method that evaluates source, so the bytes become code [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md). In a runtime's own unserializer, the parser's memory handling can be corrupted, letting a freed value be reused as attacker-controlled data and a function pointer be redirected to an eval routine [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220709205125-https-www-evonide-com-how-we-broke-php-hacked-pornhub-and-earned-20000-dollar.md). Either way, untrusted input reaches a source-evaluating sink.

## Where it shows up
- `unserialize` on a user-controlled cookie/POST parameter [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220709205125-https-www-evonide-com-how-we-broke-php-hacked-pornhub-and-earned-20000-dollar.md)
- Flight/RSC chunk deserialization resolving `$`-prefixed references to constructors or prototypes [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md)
- Attacker objects able to stand in for internal types (Response/Chunk) [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md)
- `Marshal.load` gadget chains reaching `eval(@src)` via `module_eval` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md)
- Guards applied to some eval sinks but not sibling methods [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md)

## How to review
Trace every path from untrusted bytes to an eval-like sink. The invariant: no object graph built from untrusted input may reach a source-evaluating call, and no attacker object may satisfy an internal type check. Check that chunk/reference resolution uses strict type checks, not duck-typing [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md); that every method reaching the same eval carries the same guard, and that guarded methods are zero-arg callable, since gadget chains invoke those [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md). For a runtime's own unserializer, treat parser memory safety (GC, freed-value reuse) as in scope [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220709205125-https-www-evonide-com-how-we-broke-php-hacked-pornhub-and-earned-20000-dollar.md).

## Variants seen
- Runtime unserializer plus GC use-after-free, function-pointer hijack to `zend_eval_string` [E1](https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220709205125-https-www-evonide-com-how-we-broke-php-hacked-pornhub-and-earned-20000-dollar.md)
- Protocol chunk deserialization missing type checks, resolving to `Function()` [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md)
- Guard added to some eval sinks, omitted on zero-arg siblings reachable by gadget chain [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md)

## Why fixes fail
E3 shows a partial patch: the `@_init` guard covered `result`/`run` but not `def_method`/`def_module`/`def_class`, leaving the same eval reachable. Enumerate all sinks, not just the reported one.

## Impact and severity
All three reached remote code execution. E2 was unauthenticated and exploited in the wild for miners and backdoors; E1 and E3 are not stated as in-the-wild. Severity is critical; partial guards and duck-typed type checks made it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20220709205125-https-www-evonide-com-how-we-broke-php-hacked-pornhub-and-earned-20000-dollar.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nextjs-cve-2025-55182-react2shell-deep-dive.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-q339-8rmv-2mhv.md