GitHub Advisoryadvisory · NuGet

GHSA-ph3v-2hq5-5qfq Code injection in RazorEngine

CRITICAL Published 2022-03-07 Modified 2025-03-26 Official page ↗
Aliases
CVE-2021-46703
Ecosystem
NuGet
Packages
RazorEngine
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336
Reviewed
2022-03-11

Affected packages

• NuGet RazorEngine: <= 4.5.1-alpha001 (no fix yet)

Description

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Related

Alias · CVE (1)

  • CVE-2021-46703 In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a… vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References