Better description of the import limiting for deserialization

RELEASE_NOTES.rst

@@ -27,6 +27,14 @@ Airflow 2.5.0 (2022-12-02)
 Significant Changes
 ^^^^^^^^^^^^^^^^^^^
 
+``allowed_deserialization_classes`` restrict what classed might be used in XCom
+"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+
+  In order to improve security of Airflow, only allowed classes can be used to pass data via
+  XCom. The administrators of Airflow should add all such classes to the allowed list of classes
+  in ``allowed_deserialization_classes`` in ``core`` section of Airflow configuration.
+
+
 ``airflow dags test`` no longer performs a backfill job (#26400)
 """"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
 

airflow/utils/json.py

@@ -212,7 +212,11 @@ def object_hook(self, dct: dict) -> object:
                     break
 
             if not cls:
-                raise ImportError(f"{classname} was not found in allow list for import")
+                raise ImportError(
+                    f"{classname} was not found in allow list for import in XCom. "
+                    "If you want to continue to use your class in XCom, add it to "
+                    "allowed_deserialization_classes config in core section of config."
+                )
 
             if hasattr(cls, "deserialize"):
                 return getattr(cls, "deserialize")(dct[DATA], dct[VERSION])