Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. Csla
  4. ›
  5. CVE-2025-66631

CVE-2025-66631: Csla affected by Remote Code Execution via WcfProxy (NetDataContractSerializer)

December 8, 2025 (updated December 9, 2025)

Versions of CSLA .NET prior to version 6 allow the use of WcfProxy. WcfProxy uses the NetDataContractSerializer (NDCS) which has known vulnerabilities that can allow remote execution of code during deserialization. NDCS itself is considered obsolete, and you should avoid using WcfProxy or upgrade to CSLA 6 or higher where this issue does not exist.

References

  • github.com/MarimerLLC/csla
  • github.com/MarimerLLC/csla/issues/4001
  • github.com/MarimerLLC/csla/pull/4018
  • github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v
  • github.com/advisories/GHSA-wq34-7f4g-953v
  • learn.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2310
  • nvd.nist.gov/vuln/detail/CVE-2025-66631

Code Behaviors & Features

Detect and mitigate CVE-2025-66631 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 6.0.0

Fixed versions

  • 6.0.0

Solution

Upgrade to version 6.0.0 or above.

Impact 9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-502: Deserialization of Untrusted Data

Source file

nuget/Csla/CVE-2025-66631.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 14 Dec 2025 00:19:29 +0000.