DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization.