[SECURITY] Untrusted GP data is unserialized in old CSH handling