{"id":"CVE-2023-32571","aliases":["EUVD-2023-1897","GHSA-w65q-jcmv-28gj"],"status":"published","title":"Dynamic Linq vulnerable to remote code execution","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.34904,"percentile":0.98444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-697"],"published":"2023-06-22T00:00:00Z","modified":"2026-10-28T02:30:24Z","exploits":[{"source":"pocgithub","id":"SecTex/CVE-2023-32571","title":"SecTex/CVE-2023-32571","date":"2025-10-21","url":"https://github.com/SecTex/CVE-2023-32571"},{"source":"pocgithub","id":"Tris0n/CVE-2023-32571-POC","title":"Tris0n/CVE-2023-32571-POC","date":"2023-11-18","url":"https://github.com/Tris0n/CVE-2023-32571-POC"},{"source":"pocgithub","id":"vert16x/CVE-2023-32571-POC","title":"vert16x/CVE-2023-32571-POC","date":"2023-11-18","url":"https://github.com/vert16x/CVE-2023-32571-POC"}],"fixes":[{"ecosystem":"NuGet","package":"System.Linq.Dynamic.Core","fixed_in":["1.3.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"System.Linq.Dynamic.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7.10"},{"fixed":"1.3.0"}]}]},{"source":"osv","ecosystem":"NuGet","package":"System.Linq.Dynamic.Core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.7.10"},{"fixed":"1.3.0"}]}],"versions":["1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.20","1.0.21","1.0.22","1.0.23","1.0.24","1.0.7.10","1.0.7.11","1.0.7.12","1.0.7.13","1.0.8","1.0.8.1","1.0.8.10","1.0.8.11","1.0.8.12","1.0.8.13","1.0.8.14","1.0.8.15","1.0.8.16","1.0.8.17","1.0.8.18","1.0.8.2","1.0.8.3","1.0.8.4","1.0.8.5","1.0.8.6","1.0.8.7","1.0.8.8","1.0.8.9","1.0.9","1.0.9.1","1.0.9.2","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.14","1.2.15","1.2.16","1.2.17","1.2.18","1.2.19","1.2.2","1.2.20","1.2.20-preview-01","1.2.21","1.2.22","1.2.23","1.2.24","1.2.25","1.2.3","1.2.4","1.2.5","1.2.6","1.2.6-preview-01","1.2.7","1.2.7-preview-01","1.2.7-preview-02","1.2.7-preview-03","1.2.8","1.2.9"]}],"products":[{"vendor":"dynamic-linq","product":"linq"}],"references":[{"url":"https://github.com/zzzprojects/System.Linq.Dynamic.Core","tags":["x_transferred","Product","package"]},{"url":"https://research.nccgroup.com/2023/06/13/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571/","tags":["x_transferred","Exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32571","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w65q-jcmv-28gj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32571.json","tags":["advisory"]},{"url":"https://research.nccgroup.com/2023/06/13/dynamic-linq-injection-remote-code-execution-vulnerability-cve-2023-32571","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-32571","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T00:00:00Z","modified":"2024-12-06T15:23:54.728Z","updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-1897","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T00:00:00Z","modified":"2024-12-06T15:23:54Z","updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-w65q-jcmv-28gj","title":"Dynamic Linq vulnerable to remote code execution","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T21:30:49Z","modified":"2023-11-07T05:01:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2023-32571","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T20:15:09.64Z","modified":"2026-06-17T05:59:08.8Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:08:12.414559Z"}],"osv":[{"id":"GHSA-w65q-jcmv-28gj","title":"Dynamic Linq vulnerable to remote code execution","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T21:30:49Z","modified":"2024-02-21T05:32:21.968258Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"CVE-2023-32571","description":"Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.","status":"published","published":"2023-06-22T00:00:00Z","modified":"2026-10-28T02:30:24.846830748Z","updated_at":"2026-11-02T15:44:32.116263Z"}]}}