System.Text.Json is vulnerable

Question

According to NuGet Package Manager:

When will this vulnerability be addressed? I see there is now a System.Text.Json version 8.0.4 which does not have the vulnerability status.

Answer 1

I also have this issue. It appears the latest version that is NOT vulnerable is 6.0.9?

Are we expected to downgrade our code to 6.0.9?

Answer 2

Here's how to solve this:
The latest is not visible because it is tied to newer .net 8 SDK . ( .net sdk 8.0.401 release)
Download the latest for your Vstudio from here
https://dotnet.microsoft.com/en-us/download/visual-studio-sdks
Then reload your project ( or close/ open VS)
You'll see the latest non-vulnerable 8.0.4 (as of today)

Answer 3

You need to add the reference manually to your csproj file to solve the vulnerability. You need first to look at https://www.nuget.org/ to find the more recent versions of that library and try one that solves your issue, for example:

<PackageReference Include="System.Text.Json" Version="8.0.5" />

Answer 4

You may need to restart Visual Studio to correct this. I had 9.0.1 installed but I still got the warnings. A restart cleared the message.