Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

litedb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8NuGetPublished

    LiteDB may deserialize bad JSON on object type using _type

    CVE-2022-23535 · GHSA-3x49-g6rc-c284

    Affected
    • NuGet litedb < 5.0.13
    Fixed in
    5.0.13· Vendor fix available
    Issue
    Impact LiteDB use a special field in JSON documents to cast diferent types from BsonDocument do POCO classes. When instance of an object are not the same of class, BsonMapper use a special field type string info with full class name with assembly to be loaded and fit in your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit in your model. Patches Version = 5.0.13 add some basic fixes to avoid this, but is not 100% guaranteed when using Object type Next major version will contains a allow-list to select what king of Assembly can be loaded Workarounds - Avoid users send to your app a JSON string to be direct insert/update into database - Avoid use classes with Object type - try use an interface when possible If your app send a plain JSON string to be insert/update into database, prefer this: References See this workaround fix on this commit: https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f

    Recommended action: Upgrade to 5.0.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →