https://bokkapig.pages.dev/tags/xstream-deserialization/Recent content in XStream Deserialization on bokkapigHugoen-gbSat, 21 Feb 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/interpreter/Sat, 21 Feb 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/interpreter/Pre-auth RCE via CVE-2023-43208 XStream deserialization in Mirth Connect 4.4.0, lateral movement through MySQL credential extraction and password hash replacement, privilege escalation via Python eval() injection in an internal Flask notification app running as root.