Arbitrary code may be executed in readObject.

[75ACOL]

boofcv.io.UtilIO.load public static <T> T load( String fileName ) { @Nullable URL url = UtilIO.ensureURL(fileName); if (url == null) throw new RuntimeException("Unknown path=" + fileName); try (InputStream fileIn = url.openStream()) { ObjectInputStream in = new ObjectInputStream(fileIn); return (T)in.readObject(); } catch (IOException | ClassNotFoundException e) { throw new RuntimeException(e); } } https://snyk.io/blog/serialization-and-deserialization-in-java/