Executive brief
MessagePack-CSharp is a library used to convert data into a compact binary format for transmission. A security flaw in its 'typeless' data processing mode allows attackers to bypass safety checks that are supposed to block dangerous data types. By wrapping restricted data types inside arrays or generic containers, an attacker could potentially execute unauthorized code or manipulate application logic, depending on the specific environment.
Technical details
The vulnerability exists in the typeless deserialization feature of MessagePack-CSharp, specifically within the 'MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed' check. While the library attempts to block dangerous types, the default implementation only inspects the outer type name and does not recursively check array element types or generic type arguments. An attacker can exploit this by supplying a payload where a restricted 'gadget' type is nested within a permitted wrapper type (like an array). This bypasses the blocklist, allowing the library to instantiate potentially malicious types. Patches are available in versions 2.5.301 and 3.1.7.
Affected products
- MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7
Timeline
- 2026-06-09: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: patched: GitHub Advisory published/updated with patch info