Description
QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | QuantConnect.Common | >= 2.3.0.0, <= 2.4.0.1 | — | GHSA-ww7r-278h-48mh |