GitHub Advisory Database warns about a flaw in LuckyPennySoftware AutoMapper
KROMSE explanation
LuckyPennySoftware AutoMapper has a serious security flaw (CVE-2026-128082, CVSS 7.5). The official record says: AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs before MaxDepth is counted.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running LuckyPennySoftware AutoMapper older than 16.3.0.
- Update LuckyPennySoftware AutoMapper to 16.3.0 or later.
- Not sure if you use it? KROMSE can check your product for free.
