GitHub Advisoryadvisory · NuGet

GHSA-wq34-7f4g-953v Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)

HIGH Published 2025-12-08 Modified 2025-12-09 Official page ↗
Aliases
CVE-2025-66631
Ecosystem
NuGet
Packages
Csla
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-502
Reviewed
2025-12-08

Affected packages

• NuGet Csla: < 6.0.0 → fixed in 6.0.0

Description

Impact Versions of CSLA .NET prior to version 6 allow the use of WcfProxy. WcfProxy uses the NetDataContractSerializer (NDCS) which has known vulnerabilities that can allow remote execution of code during deserialization. NDCS itself is considered obsolete, and you should avoid using WcfProxy or upgrade to CSLA 6 or higher where this issue does not exist. Patches CSLA .NET version 6 and higher do not use WCF or NetDataContractSerializer. Workarounds If you are using a version CSLA .NET older than version 6, you should stop using WcfProxy in your data portal configuration. Doing this avoids the use of WCF and the NetDataContractSerializer, avoiding the vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-66631 CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References