CVE-2023-32571: 
C# vulnerability analysis and mitigation

Dynamic Linq versions 1.0.7.10 through 1.2.25 before 1.3.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code and commands when untrusted input is parsed through methods including Where, Select, and OrderBy. The vulnerability was assigned CVE-2023-32571 and was disclosed in June 2023 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from insufficient validation of dynamic LINQ queries that allows injection of arbitrary code through methods like Where, Select and OrderBy. The vulnerability affects the System.Linq.Dynamic.Core package (GitHub).

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code and commands on affected systems. Given the CVSS score of 9.8, this represents a critical security risk with potential for complete system compromise (NVD).

Users should upgrade to Dynamic Linq version 1.3.0 or later which contains fixes for this vulnerability. The fix includes changes to restrict method calls on object types and additional security controls around OrderBy/ThenBy operations (GitHub).