OASB
Attacks/Parser Differential/PARSE-009
CRITICALCWE-436

PARSE-009 Polyglot Payload (JSON+YAML+Markdown)

Parser Differential: Exploits differences in how parsers (JSON, YAML, markdown) interpret the same input to bypass security controls

Description

Crafts a polyglot payload that is valid in multiple formats, parsed differently by each, with the malicious interpretation hidden in one format

Remediation

Enforce a single input format per endpoint. Validate that input conforms to exactly one expected format. Reject ambiguous inputs that could be valid in multiple formats.

Severity

CRITICAL

OASB Control

3.1

CWE

CWE-436