Keep objects out of it
The root cause is turning attacker-controlled bytes back into live objects. Avoid it:
Tip: Never un-pickle (or PHP-
unserialize, or Java-deserialize) data that came from a client. Use data-only formats like JSON for anything crossing a trust boundary, keep session state server-side, and if you must send state to the client, sign it (HMAC) and verify the signature before you ever parse it.