Platform
dotnet
Component
nuget
Opgelost in
0.0.1
CVE-2026-39399 is a critical remote code execution (RCE) vulnerability affecting the NuGet Gallery, a package repository powering nuget.org. An attacker can exploit this flaw by crafting malicious .nuspec files within NuGet packages, leading to potentially severe consequences. This vulnerability impacts versions of NuGet Gallery prior to 0e80f87628349207cdcaf55358491f8a6f1ca276, and a fix is available.
The vulnerability stems from insufficient input validation when handling .nuspec files. Attackers can leverage this to inject malicious metadata across packages, effectively controlling the resolved blob path. This allows them to write arbitrary blobs within the NuGet Gallery, potentially leading to remote code execution. Successful exploitation could allow an attacker to compromise the NuGet Gallery infrastructure, inject malicious packages into the repository, and distribute them to unsuspecting developers, leading to widespread compromise of applications relying on NuGet packages. The potential for supply chain attacks is significant, as compromised packages could contain malware or backdoors.
This vulnerability was publicly disclosed on 2026-04-14. The CVSS score of 9.6 (CRITICAL) indicates a high probability of exploitation. Public proof-of-concept (POC) code is likely to emerge given the ease of exploitation and the high impact. It is recommended to monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns targeting NuGet Gallery. The vulnerability's nature makes it a potential candidate for inclusion in the CISA KEV catalog.
Developers and organizations that rely on NuGet packages from nuget.org are at risk. Specifically, those using automated build processes that automatically pull packages from nuget.org without thorough vetting are particularly vulnerable. Shared hosting environments where multiple developers share a NuGet package repository also face increased risk.
• dotnet / server: Monitor NuGet Gallery server logs for unusual blob write activity, particularly those involving URI fragment injection in package identifiers. Use PowerShell to check for suspicious .nuspec files in the package repository.
Get-ChildItem -Path "C:\path\to\nuget\packages\*\*.nuspec" | Select-String -Pattern "malicious_pattern"• generic web: Monitor access logs for requests containing unusual URI fragments in package identifiers. Check response headers for unexpected content-types or error messages related to blob writes. • database (generic): If NuGet Gallery uses a database to store package metadata, query the database for suspicious entries related to package identifiers and blob paths.
disclosure
Exploit Status
EPSS
0.30% (53% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation is to upgrade NuGet Gallery to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later, which contains the necessary fixes. If immediate upgrade is not feasible, consider implementing stricter input validation on .nuspec files within the NuGet Gallery backend job. While a direct WAF rule is difficult to implement, monitoring for unusual blob write activity and package identifier patterns can provide early detection. Review and audit all NuGet packages before publishing to ensure they do not contain malicious metadata. After upgrade, confirm the fix by attempting to upload a test package with a deliberately crafted, but benign, .nuspec file to verify that the input validation is functioning correctly.
Actualice NuGet Gallery a la versión 0e80f87628349207cdcaf55358491f8a6f1ca276 o superior para mitigar la vulnerabilidad. Esta actualización aborda la validación de entrada insuficiente en el manejo de archivos .nuspec, previniendo la inyección de metadatos entre paquetes y la posible ejecución remota de código o escritura arbitraria de blobs.
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2026-39399 is a critical remote code execution vulnerability in NuGet Gallery, allowing attackers to inject malicious metadata into NuGet packages.
You are affected if you are using NuGet Gallery and have not upgraded to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later.
Upgrade NuGet Gallery to version 0e80f87628349207cdcaf55358491f8a6f1ca276 or later. Implement stricter input validation as a temporary workaround.
While active exploitation is not yet confirmed, the high CVSS score and ease of exploitation suggest a high probability of exploitation.
Refer to the official NuGet Gallery security advisories for the most up-to-date information and guidance.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je packages.lock.json-bestand en we vertellen je direct of je getroffen bent.