Fix security bug: Deserialization of Untrusted Data