ObjectInputStream.readObject or readUnshared on untrusted data enables remote code execution.
Avoid native serialization for untrusted data; use a safe format like JSON with strict type validation.