Security: Fix RCE via unsafe deserialization in Cosmos metadata cache#47971

Draft

Copilot wants to merge 8 commits intomainfrom

copilot/fix-unsafe-deserialization

Commits on Feb 11, 2026

Address PR feedback: remove security tag, add PR link, clarify comments

Copilot
and
tvaron3
committed
Fix allowlist in SafeObjectInputStream to include all transitively deserialized classes

Copilot
and
tvaron3
committed

Commits on Feb 12, 2026

Fix RCE vulnerability by implementing SafeObjectInputStream with class allowlisting for secure deserialization
tvaron3
committed