Unsafe JSON deserialization with TypeNameHandling
JsonConvert.DeserializeObject uses TypeNameHandling.Auto which can lead to remote code execution via crafted JSON payloads.
CWE
CWE-502
CVE
N/A
OWASP
A08:2021-Software and Data Integrity
CVSS Score
9.1
Source
SAST
Category
Insecure Deserialization
Exploitability
Exploitable
Detected
2026-05-28 19:02
Code Location
src/Services/DataImporter.cs:89JsonConvert.DeserializeObject<ImportData>(json, new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.Auto })AI Explanation
TypeNameHandling.Auto allows an attacker to specify arbitrary .NET types in the JSON payload, potentially leading to remote code execution.
Remediation Suggestion
Remove TypeNameHandling.Auto. Use TypeNameHandling.None (default) or migrate to System.Text.Json which doesn't support polymorphic deserialization by default.
Related Findings
| Severity | Title | CWE | Status |
|---|---|---|---|
Critical |
pickle.load() used on untrusted model file | CWE-502 | Open |
Change Status