CVE-2026-50523: Csharp Serialization On Deserialized Hook

A method is decorated with the [OnDeserialized] attribute. Deserialization event callbacks execute automatically during object deserialization and can be leveraged as gadget chains during unsafe binary deserialization.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0C#
greprules fetch cve-2026-50523-csharp-serialization-on-deserialized-hook --engine opengrep

Description

A method is decorated with the [OnDeserialized] attribute. Deserialization event callbacks execute automatically during object deserialization and can be leveraged as gadget chains during unsafe binary deserialization.