{"id":"CVE-2022-23535","aliases":["GHSA-3x49-g6rc-c284"],"url":"https://o3.security/vulnerability/CVE-2022-23535","summary":"LiteDB contains Deserialization of Untrusted Data","details":"### Impact\nLiteDB use a special field in JSON documents to cast diferent types from `BsonDocument` do POCO classes. When instance of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit in your model.\nIf your end-user can send to your app a plain JSON string, deserialization can load an unsafe  object to fit in your model.\n\n### Patches\nVersion >= 5.0.13 add some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type\nNext major version will contains a allow-list to select what king of Assembly can be loaded\n\n### Workarounds\n- Avoid users send to your app a JSON string to be direct insert/update into database\n- Avoid use classes with `Object` type - try use an interface when possible\n\nIf your app send a plain JSON string to be insert/update into database, prefer this:\n```\n// Bad\npublic class Customer {\n    public int Id { get; set; }\n    public string Name { get; set; }\n    public Object AnyData { get; set; } // <= Avoid use `Object` base type\n}\n\n// Good\npublic class Customer {\n    public int Id { get; set; }\n    public string Name { get; set; }\n    public IDictionary<string, string> AnyData { get; set; } // Will accept only key/value strings\n}\n\n```\n\n### References\nSee this workaround fix on this commit:\n\nhttps://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f\n","published":"2023-02-24T22:40:06.444Z","modified":"2026-08-27T03:31:07.345986614Z","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":{"score":0.00699,"percentile":0.5007,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"LiteDB","fixedVersion":"5.0.13"}],"fix":{"url":"https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f","label":"mbdavid/LiteDB@4382ff4"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23535.json"},{"type":"ADVISORY","url":"https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23535"},{"type":"FIX","url":"https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f"},{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2"},{"type":"PACKAGE","url":"https://github.com/mbdavid/LiteDB"},{"type":"WEB","url":"https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:31:07.345986614Z"}}