AIKIDO-2026-10924
MessagePack is vulnerable to Insecure Deserialization
75
High Risk
This Affects:
MessagePackTL;DR
The MessagePack typeless deserializer checks incoming type names against a built-in DisallowedTypes denylist before instantiation. Before the patch, several high-impact gadget types such as System.Diagnostics.Process and System.Data.DataSet were not on that list, so crafted typeless MessagePack payloads could deserialize them when the application used the Typeless API on untrusted data. That enables gadget-chain attacks that can lead to remote code execution. The fix adds these and other known unsafe gadget types to the default denylist so deserialization is rejected.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
MessagePack is vulnerable to Insecure Deserialization in versions 2.2.85 - 2.5.192 and 3.0.134 - 3.1.5.
How to fix this
Upgrade the MessagePack library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant