Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M

CVE-2025-66631CSLA .NET is vulnerable to Remote Code Execution via WcfProxy

High 7.2

In plain English

A high-severity unsafe deserialization in csla from MarimerLLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.7%top 47.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
NuGet	csla	6.0.0	GHSA-wq34-7f4g-953v

Affected products (as reported)

Vendor	Product	Versions
MarimerLLC	csla	< 6.0.0

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

https://github.com/MarimerLLC/csla/security/advisories/GHSA-wq34-7f4g-953v x_refsource_CONFIRM
https://github.com/MarimerLLC/csla/issues/4001 x_refsource_MISC
https://github.com/MarimerLLC/csla/pull/4018 x_refsource_MISC