[RazorEngine] Code injection in RazorEngine

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-46703
• https://github.com/Antaris/RazorEngine/issues/585
• https://github.com/advisories/GHSA-ph3v-2hq5-5qfq