Peng@Shu)

The issue concerns Arbitrary Code Execution via the ReceiveVarData<T> function in the SocketClient.cs component. This occurs because the socket client transmission lacks appropriate restrictions or type bindings for the BinaryFormatter, allowing a payload to be passed via user-controllable input after the connection is established.

The issue allows alteration of all Object attributes, including magical attributes such as `proto`, `constructor`, and `prototype`, leading to Prototype Pollution.

The issue concerns the socket client in the SinGooCMS.Utility package, which lacks appropriate restrictions or type bindings for the BinaryFormatter. This allows user-controllable input to pass in the payload after the socket client has been established.

The issue affects the package swiper, making versions prior to 6.5.1 susceptible to prototype pollution.