vetkit.csharp.code-injection.dynamic-linq
A System.Linq.Dynamic expression string is built from request input. Dynamic LINQ parses and compiles the string, so an attacker can change the query or, on older library versions, invoke arbitrary methods.
Last updated:
Suite: Security
csharp
A System.Linq.Dynamic expression string is built from request input. Dynamic LINQ parses and compiles the string, so an attacker can change the query or, on older library versions, invoke arbitrary methods.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Map sort/filter fields through an allow-list and pass values as parameters (@0, @1) instead of concatenating them into the expression; keep System.Linq.Dynamic.Core up to date.
References
Source: packages/engine/rules/sast/csharp.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.