CVE-2018-14878

HIGH 7.8CVE-2018-14878 · Published 13/08/2018 · updated 17/06/2026

In short

CVE-2018-14878 is a HIGH (CVSS 7.8) vulnerability affecting dotpeek (jetbrains), resharper ultimate (jetbrains).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.3% of all vulnerabilities.
Fix: update to 2018.2 or later.

Package	Affected versions	Patched versions
dotpeek jetbrains	`< 2018.2`	`2018.2`
resharper ultimate jetbrains	`≤ 2018.1.4`	No fix yet

Description

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data.

References

blog.jetbrains.com/dotnet/2018/08/02/resharper-ultimate-2018-1-4-rider-2018-1-4-released · Patch
nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/august/aspnet-resource-files-resx-and-deserialisation-issues · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free