LiteDB

LiteDB - A lightweight embedded .NET NoSQL document store in a single datafile

View on Nuget

Activity

Latest release: 2d ago
Total releases: 141
Cadence: ~daily
Last 12 months: 64

Details

License: MIT
First release: Aug 25, 2014

Releases

Version	Released
`6.0.0-prerelease.355` pre	Oct 26, 2026
`6.0.0-prerelease.354` pre	Oct 26, 2026
`6.0.0-prerelease.350` pre	Oct 26, 2026
`6.0.0-prerelease.348` pre	Oct 26, 2026
`6.0.0-prerelease.347` pre	Oct 26, 2026
`6.0.0-prerelease.346` pre	Oct 26, 2026
`6.0.0-prerelease.344` pre	Oct 25, 2026
`6.0.0-prerelease.340` pre	Oct 25, 2026
`6.0.0-prerelease.326` pre	Oct 25, 2026
`6.0.0-prerelease.325` pre	Oct 25, 2026
`6.0.0-prerelease.324` pre	Oct 25, 2026
`6.0.0-prerelease.323` pre	Oct 25, 2026
`6.0.0-prerelease.322` pre	Oct 01, 2026
`6.0.0-prerelease.321` pre	Oct 01, 2026
`6.0.0-prerelease.319` pre	Sep 28, 2026
`6.0.0-prerelease.318` pre	Sep 28, 2026
`6.0.0-prerelease.317` pre	Sep 28, 2026
`6.0.0-prerelease.316` pre	Sep 28, 2026
`6.0.0-prerelease.315` pre	Sep 28, 2026
`6.0.0-prerelease.311` pre	Sep 24, 2026
`6.0.0-prerelease.309` pre	Sep 24, 2026
`6.0.0-prerelease.305` pre	Sep 22, 2026
`6.0.0-prerelease.304` pre	Sep 22, 2026
`6.0.0-prerelease.303` pre	Sep 22, 2026
`6.0.0-prerelease.302` pre	Sep 21, 2026
`6.0.0-prerelease.300` pre	Sep 21, 2026
`6.0.0-prerelease.298` pre	Sep 21, 2026
`6.0.0-prerelease.297` pre	Sep 21, 2026
`6.0.0-prerelease.296` pre	Sep 20, 2026
`6.0.0-prerelease.295` pre	Sep 20, 2026
`6.0.0-prerelease.294` pre	Sep 20, 2026
`6.0.0-prerelease.292` pre	Sep 20, 2026
`6.0.0-prerelease.291` pre	Sep 20, 2026
`6.0.0-prerelease.289` pre	Sep 19, 2026
`6.0.0-prerelease.275` pre	Sep 19, 2026
`6.0.0-prerelease.270` pre	Sep 18, 2026
`6.0.0-prerelease.222` pre	Sep 18, 2026
`6.0.0-prerelease.194` pre	Sep 18, 2026
`6.0.0-prerelease.192` pre	Sep 16, 2026
`6.0.0-prerelease.187` pre	Sep 16, 2026
`6.0.0-prerelease.186` pre	Sep 16, 2026
`6.0.0-prerelease.185` pre	Sep 16, 2026
`6.0.0-prerelease.184` pre	Sep 16, 2026
`6.0.0-prerelease.183` pre	Sep 16, 2026
`6.0.0-prerelease.181` pre	Sep 13, 2026
`6.0.0-prerelease.180` pre	Sep 13, 2026
`6.0.0-prerelease.179` pre	Sep 13, 2026
`6.0.0-prerelease.178` pre	Sep 13, 2026
`6.0.0-prerelease.165` pre	Sep 13, 2026
`6.0.0-prerelease.169` pre	Sep 13, 2026

1–50 of 141

Dependencies (2)

Depends on

6.0.0-prerelease.355

Used by

475

Supply-chain exposure

475 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2022-23535 GHSA-3x49-g6rc-c284 Feb 24, 2023

LiteDB may deserialize bad JSON on object type using _type

9.8 / 10
Critical
Network Low None None Unchanged High High High

Impact

LiteDB use a special field in JSON documents to cast diferent types from BsonDocument do POCO classes. When instance of an object are not the same of class, BsonMapper use a special field _type string info with full class name with assembly to be loaded and fit in your model. If your end-user can send to your app a plain JSON string, deserialization can load an unsafe object to fit in your model.

Patches

Version >= 5.0.13 add some basic fixes to avoid this, but is not 100% guaranteed when using Object type Next major version will contains a allow-list to select what king of Assembly can be loaded

Workarounds

Avoid users send to your app a JSON string to be direct insert/update into database

Avoid use classes with Object type - try use an interface when possible

If your app send a plain JSON string to be insert/update into database, prefer this:

// Bad public class Customer { public int Id { get; set; } public string Name { get; set; } public Object AnyData { get; set; } // <= Avoid use `Object` base type } // Good public class Customer { public int Id { get; set; } public string Name { get; set; } public IDictionary<string, string> AnyData { get; set; } // Will accept only key/value strings }

References

See this workaround fix on this commit:

https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f

Affected versions

0.5.00.6.00.8.00.9.01.0.01.0.11.0.21.0.31.0.41.0.52.0.02.0.0-beta

+ 42 more Show less

2.0.0-rc2.0.0-rc22.0.12.0.22.0.32.0.43.0.03.0.0-beta3.0.0-beta23.0.0-beta33.0.13.1.03.1.13.1.23.1.33.1.43.1.54.0.04.0.0-beta14.0.0-beta24.1.04.1.14.1.24.1.34.1.45.0.05.0.0-alpha5.0.0-alpha25.0.0-beta5.0.0-rc5.0.15.0.105.0.115.0.125.0.25.0.35.0.45.0.55.0.65.0.75.0.85.0.9

Fixed in

5.0.13

References

https://github.com/mbdavid/LiteDB/security/advisories/GHSA-3x49-g6rc-c284
https://nvd.nist.gov/vuln/detail/CVE-2022-23535
https://github.com/mbdavid/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f
https://github.com/mbdavid/LiteDB/commit/d72c6774e6a13de2cfcd7d477d3575efeb75c8f2
https://github.com/mbdavid/LiteDB
https://github.com/mbdavid/LiteDB/releases/tag/v5.0.13

Updated Nov 08, 2023 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 5
minor 5
patch 35
pre 95

141 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More