DeepSource
Dashboard Resources Pricing Discover Directory Log in

Run your first analysis.

Find thousands of code security and quality issues in your codebase, before they end up in production.

Start now
C#

C#

Made by DeepSource
Use Analyzer

Binary Formatter deserializes data in an insecure manner and should not be used CS-S1006

Security
Critical
 a08 cwe-502 sans top 25 owasp top 10

According to Microsoft, BinaryFormatter deserializes data in an insecure manner and using it is "equivalent of interpreting the payload as a standalone executable and launching it". It is therefore recommended that you switch to preferred alternatives that can handle untrusted data safely such as XmlSerializer, DataContractSerializer, BinaryReader, BinaryWriter, or System.Text.Json.

Reference