Read the docs
TI-2022-07590 Aliases CVE-2022-23535GHSA-3x49-g6rc-c284

LiteDB contains Deserialization of Untrusted Data

Priority MEDIUM 49CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00699 53rd percentileScored 2026-11-07
Fix Fixed LiteDB (mbdavid): 5.0.13LiteDB (NuGet): 5.0.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mbdavidLiteDBbefore 5.0.135.0.13Patch availableCNA
—LiteDB (NuGet)before 5.0.135.0.13Patch availableGHSA-3x49-g6rc-c284
  • LiteDB Vendormbdavid Affected before 5.0.13 Fixed in 5.0.13 Patch available CNA
  • LiteDB (NuGet) Vendor— Affected before 5.0.13 Fixed in 5.0.13 Patch available GHSA-3x49-g6rc-c284

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:litedb:litedb:*:*:*:*:*:.net:*:*before 5.0.13VulnerableLitedb
  • cpe:2.3:a:litedb:litedb:*:*:*:*:*:.net:*:* Versions before 5.0.13 Vulnerable ·Litedb

Remediation

  • Fix · CNA LiteDB (mbdavid) Fixed in 5.0.13
  • Fix · GHSA-3x49-g6rc-c284 LiteDB (NuGet) Fixed in 5.0.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23535
  2. 2026-10-03 Alias added: GHSA-3x49-g6rc-c284

References

Patch 2

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences