Platform
dotnet
Component
nuget
Fixed in
0.0.1
CVE-2026-39399 is a critical remote code execution (RCE) vulnerability affecting the NuGet Gallery, a package repository powering nuget.org. An attacker can exploit this flaw by crafting malicious .nuspec files within NuGet packages, leading to potentially severe consequences. This vulnerability impacts versions of NuGet Gallery prior to 0e80f87628349207cdcaf55358491f8a6f1ca276, and a fix is available.
The vulnerability stems from insufficient input validation when handling .nuspec files. Attackers can leverage this to inject malicious metadata across packages, effectively controlling the resolved blob path. This allows them to write arbitrary blobs within the NuGet Gallery, potentially leading to remote code execution. Successful exploitation could allow an attacker to compromise the NuGet Gallery infrastructure, inject malicious packages into the repository, and distribute them to unsuspecting developers, leading to widespread compromise of applications relying on NuGet packages. The potential for supply chain attacks is significant, as compromised packages could contain malware or backdoors.
This vulnerability was publicly disclosed on 2026-04-14. The CVSS score of 9.6 (CRITICAL) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge given the ease of exploitation and the high impact. It is recommended to monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns targeting NuGet Gallery. The vulnerability's nature makes it a potential candidate for inclusion in the CISA KEV catalog.
Exploit Status
EPSS
0.30% (53% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade NuGet Gallery to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later, which contains the necessary fixes. If immediate upgrade is not feasible, consider implementing stricter input validation on .nuspec files within the NuGet Gallery backend job. While a direct WAF rule is difficult to implement, monitoring for unusual blob write activity and package identifier patterns can provide early detection. Review and audit all NuGet packages before publishing to ensure they do not contain malicious metadata. After upgrade, confirm the fix by attempting to upload a test package with a deliberately crafted, but benign, .nuspec file to verify that the input validation is functioning correctly.
Actualice NuGet Gallery a la versión 0e80f87628349207cdcaf55358491f8a6f1ca276 o superior para mitigar la vulnerabilidad. Esta actualización aborda la validación de entrada insuficiente en el manejo de archivos .nuspec, previniendo la inyección de metadatos entre paquetes y la posible ejecución remota de código o escritura arbitraria de blobs.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-39399 is a critical remote code execution vulnerability in NuGet Gallery, allowing attackers to inject malicious metadata into NuGet packages.
You are affected if you are using NuGet Gallery and have not upgraded to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later.
Upgrade NuGet Gallery to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later. Implement stricter input validation as a temporary workaround.
While active exploitation is not yet confirmed, the high CVSS score and ease of exploitation suggest a high probability of exploitation.
Refer to the official NuGet Gallery security advisories for the most up-to-date information and guidance.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your packages.lock.json file and we'll tell you instantly if you're affected.