1 of 3

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer might be in danger.

Here are some examples of subtle points: