.NET Deserialization: BinaryFormatter, Json.NET and TypeNameHandling
On .NET, the type information lives inside the payload. BinaryFormatter and a Json.NET $type directive will happily instantiate whatever class an attacker names — including gadgets that reach a process start. Here is how it leads to RCE, and the binder allowlist that stops it.