critical9.8
CVE-2023-32571
Dynamic Linq vulnerable to remote code execution
Impact
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| nuget | System.Linq.Dynamic.Core | >= 1.0.7.10, < 1.3.0 | 1.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dynamic-Linq | Linq | from 1.0.7.10 through 1.2.25 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/zzzprojects/System.Linq.Dynamic.Core
- https://research.nccgroup.com/2023/06/13/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571/
- https://github.com/advisories/GHSA-w65q-jcmv-28gj
- https://nvd.nist.gov/vuln/detail/CVE-2023-32571