MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table/addField.