Some formats describe not only data but also which function to call to rebuild it. If an attacker controls the bytes, they choose the function. Plain-data formats like JSON, plus schema validation, avoid this. See pickle.