AIKIDO-2025-10420
ServiceStack.Text is vulnerable to Unsafe Deserialization
91
Critical Risk
This Affects:
ServiceStack.TextTL;DR
Affected versions of this package are vulnerable to deserialization of untrusted data in the ServiceStack.NetFxPclExport.FindType() method. An attacker can execute arbitrary code by providing a crafted path to a malicious DLL or EXE file, which is not properly validated before being used in file operations. Successful exploitation requires the malicious file to be present on the local filesystem, which typically depends on a separate vulnerability or attacker with elevated privileges.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
ServiceStack.Text is vulnerable to Unsafe Deserialization in versions 6.0.0 - 8.5.2.
How to fix this
Upgrade the ServiceStack.Text library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant