Type.GetType or Activator.CreateInstance is invoked with a variable type name from untrusted input.
Map user input to an allowlisted set of known types rather than resolving arbitrary type names.