Json.NET is configured with TypeNameHandling.All or Auto, enabling type-confusion deserialization attacks.
Set TypeNameHandling to None or use a strict SerializationBinder that allowlists safe types.