it certainly can be... https://owasp.org/www-pdf-archive/Marshaller_Deserialization...