Authenticated code execution via WebPart namespace mismatch

Code injection in SharePoint builds before 15.0.5345.1000, 16.0.5161.1000, or 16.0.10374.20000 allows remote authenticated users to run code. EditingPageParser.VerifyControlOnSafeList fails to trim a Register directive namespace before resolving it, while later processing trims the value and instantiates a blocked XmlDataSource control; the control reads web.config so its machine key can sign a malicious ViewState. Exploitation requires ManageLists permission, which authenticated users can obtain by creating a site under the documented default configuration, and commands run as the SharePoint web application service account.