Zed Attack Proxy’s ViewState add‑on before version 4 contains an insecure deserialization flaw that enables arbitrary code execution. The flaw resides in the JSFViewState.decode() method, which base64‑decodes the javax.faces.ViewState HTTP response parameter and forwards it directly to ObjectInputStream.readObject() without any deserialization filtering or type restrictions. Attacking a target that can inject a malicious serialized Java object into that ViewState value therefore results in the deserialization of that object within the ZAP desktop JVM and the execution of attacker‑supplied code.

The vulnerability affects the Zed Attack Proxy (ZAP) ViewState add‑on distributed under the zaproxy:zap-extensions vendor for any version prior to the release tagged viewstate‑v4. Users running the add‑on on older releases should verify their current version and plan an upgrade if the add‑on is still installed.

The CVSS score of 8.7 indicates a high‑severity flaw, yet the EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who controls a proxied web server being able to inject a malicious ViewState payload; the flaw is not exploitable simply by visiting a target site, but requires manipulation of responses sent through ZAP’s proxy. Given the high severity and the lack of observable exploitation, administrators should treat this as a serious risk until a patch is applied.