-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
C#C#Miggo AIRoot Cause AnalysisThe vulnerability stems from how BsonMapper handles '_type' during deserialization. The commit 4382ff4 adds two critical checks: 1) IsAssignableFrom validation to ensure type compatibility, and 2) explicit blocking of System.Diagnostics.Process. The original code (shown in the diff) lacked these checks, making the Deserialize method vulnerable to type confusion attacks. The function's responsibility to resolve and validate types based on untrusted '_type' values directly matches the described exploit scenario where malicious types could be loaded via user-controlled JSON.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| LiteDB | nuget | < 5.0.13 | 5.0.13 |