CVE-2021-42777

Stimulsoft Reports, when Compilation Mode is enabled, will execute arbitrary C# embedded in a report on any machine that renders it — the proof being a System.Diagnostics.Process.Start call. In plain terms, a report file is a code file: whoever opens or renders it runs the attacker's C# with the privileges of the rendering process, whether that's the application server or an end user's local machine. The report engine treats template logic as trusted, and that trust is the vulnerability.

This is dangerous because reports circulate like documents — they're emailed, shared, and loaded from repositories by people who think of them as data, not executables. The condition that gates it is Compilation Mode being in use, but where it is, a malicious report is a clean delivery vehicle for code execution, and rendering on the server side means one poisoned template can compromise a shared backend rather than a single desktop. It's a targeted or supply-chain style vector rather than mass-scanned, but the payoff — server or workstation code execution from a file people trust — is high.

Our emphasis is configuration state and the trust boundary around report sources. We'd determine where Stimulsoft rendering runs, whether Compilation Mode is enabled, and critically whether reports from untrusted or user-supplied sources ever reach the renderer — that last point is what turns the feature into a weapon. Locking rendering to trusted templates and disabling compilation where it isn't needed is the practical control; we rank instances by whether externally-authored reports can reach a server-side renderer, which is the worst case.