Description
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
Exploits (3)
Scores
CVSS v3
9.8
EPSS
0.7691
EPSS Percentile
99.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lab Environment
Details
CWE
CWE-697
Status
published
Products (2)
dynamic-linq/linq
1.0.7.10 - 1.2.25
nuget/System.Linq.Dynamic.Core
1.0.7.10 - 1.3.0NuGet
Published
Jun 22, 2023
Tracked Since
Feb 18, 2026