Improper control of code generation, specifically code injection, allows an authorized remote attacker to execute arbitrary code over a network. This is caused by the deserialization of untrusted data via the `DataSetSurrogateSelector` function. An attacker can achieve remote code execution on the server by sending a specially crafted POST request containing malicious WebPart markup. Real-world exploitation of this issue has been documented.