Code execution via arbitrary class state injection

Insecure deserialization in APScheduler 4.0.0a1 through 4.0.0a6 allows attackers to execute code via crafted JSON or CBOR data. The JSONSerializer object hook passes an attacker-selected class reference and state to unmarshal_object, which imports and instantiates the class before invoking its state-restoration method with the supplied data. Exploitation requires an application to deserialize attacker-controlled data with either serializer, and resulting code runs with the scheduler process's privileges.