{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azzzprojectssystem.linq.dynamic.core/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zzzprojects:system.linq.dynamic.core:*:*:*:*:*:*:*:*","cpe:2.3:a:dynamic-linq:linq:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-32571"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["System.Linq.Dynamic.Core (1.0.7.10 - 1.2.25)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["zzzprojects"],"content_html":"\u003cp\u003eCVE-2023-32571 is a remote code execution vulnerability in the System.Linq.Dynamic.Core library. The flaw exists in the way the library parses untrusted input within specific LINQ methods, including Where, Select, and OrderBy. Successful exploitation allows for arbitrary assembly loading or direct system command execution. A public proof-of-concept exploit is available, demonstrating both assembly injection and direct process spawning.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated, remote attackers to achieve full remote code execution on the underlying host. The CVSS score is 9.8 (Critical), reflecting the ability to achieve high levels of confidentiality, integrity, and availability impact without requiring user interaction or privileges.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory applications using the System.Linq.Dynamic.Core library to identify instances running versions within the 1.0.7.10 to 1.2.25 range.\u003c/li\u003e\n\u003cli\u003eUpdate the library dependency to a version beyond 1.2.25 to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for all data passed to LINQ query methods if immediate patching is not possible.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-24T21:31:16Z","date_published":"2026-10-24T21:31:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-system-linq-dynamic-core-rce/","summary":"CVE-2023-32571 is a critical remote code execution vulnerability in System.Linq.Dynamic.Core affecting versions 1.0.7.10 through 1.2.25, triggered by the parsing of untrusted input in LINQ query methods.","title":"System.Linq.Dynamic.Core: Remote Code Execution (CVE-2023-32571)","url":"https://feed.craftedsignal.io/briefs/2026-10-system-linq-dynamic-core-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zzzprojects:system.linq.dynamic.core:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}