A flaw was found in the NuGet package AutoMapper

2026-11-13

KROMSE explanation

LuckyPennySoftware AutoMapper has a serious security flaw (CVE-2026-128081, CVSS 7.5). The official record says: AutoMapper is a convention-based object-object mapper in .NET.

No confirmed attacks and no public attack code yet.

Anyone running LuckyPennySoftware AutoMapper older than 16.3.0.

Update LuckyPennySoftware AutoMapper to 16.3.0 or later.
Not sure if you use it? KROMSE can check your product for free.

KROMSELive threat centreSign inAdd your repository or website to see if it impacts youAdd repo or website

A flaw was found in the NuGet package AutoMapper

KROMSE explanation

Loading the story…