Unrated
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeName...
CVE-2020-20136
First seen on SecPulse
Original description The description as published by the source.
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- report github.com