Описание
Code injection in RazorEngine
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Пакеты
Наименование
RazorEngine
nuget
Затронутые версииВерсия исправления
<= 4.5.1-alpha001
Отсутствует
Связанные уязвимости
CVSS3: 9.8
nvd
почти 4 года назад
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer