MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.