diff --git a/data/GitHub Actions/GHSA-6f4g-xm8v-pgv6.json b/data/GitHub Actions/GHSA-6f4g-xm8v-pgv6.json index ec94adac77..92442607f2 100644 --- a/data/GitHub Actions/GHSA-6f4g-xm8v-pgv6.json +++ b/data/GitHub Actions/GHSA-6f4g-xm8v-pgv6.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"GHSA-6f4g-xm8v-pgv6","published":"2026-11-10T15:56:59Z","modified":"2026-11-10T16:15:05.047506371Z","aliases":["CVE-2026-123369"],"summary":"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action","details":"### Impact\n\nThe GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:\n\n- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`)\n- fold the rest of the log, including the real verdict, out of sight (`##[group]`)\n- blank out chosen strings for the rest of the log (`##[add-mask]`)\n\nGitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action's own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.\n\nThe exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.\n\nFound during an internal pre-1.0 security review.\n\n### Patches\n\nFixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint's output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.\n\n### Workarounds\n\n- In your own workflow, wrap the compose-lint step in `::stop-commands::` and `::::`.\n- Use `--format json` or `--format sarif` rather than the text report when linting untrusted pull requests.\n\n### Reproduction\n\n```yaml\nservices:\n web:\n image: \"nginx:1.25\"\n environment:\n \"##[error]DB_PASSWORD\": placeholder\n \"##[group]svc\":\n image: \"nginx:1.25\"\n privileged: true\n```\n\nRun through the Action, this produces a fake error annotation and folds the remaining log lines, including the FAIL verdict, into a collapsed group.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.31.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"60c091c7cc8f86c6b0c5954031097364fea0a201"},{"fixed":"a6a7a76736de1c72abfa96c41ff8af556ffdc55f"}]}],"versions":["v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.2","v0.15.1","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.7","v0.3.6","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}},{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123369"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/918"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:56:59Z","nvd_published_at":"2026-11-09T18:17:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-6f4g-xm8v-pgv6","published":"2026-11-10T15:56:59Z","modified":"2026-11-11T02:57:10.295103665Z","aliases":["CVE-2026-123369"],"related":["CVE-2026-125121"],"summary":"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action","details":"### Impact\n\nThe GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:\n\n- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`)\n- fold the rest of the log, including the real verdict, out of sight (`##[group]`)\n- blank out chosen strings for the rest of the log (`##[add-mask]`)\n\nGitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action's own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.\n\nThe exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.\n\nFound during an internal pre-1.0 security review.\n\n### Patches\n\nFixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint's output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.\n\n### Workarounds\n\n- In your own workflow, wrap the compose-lint step in `::stop-commands::` and `::::`.\n- Use `--format json` or `--format sarif` rather than the text report when linting untrusted pull requests.\n\n### Reproduction\n\n```yaml\nservices:\n web:\n image: \"nginx:1.25\"\n environment:\n \"##[error]DB_PASSWORD\": placeholder\n \"##[group]svc\":\n image: \"nginx:1.25\"\n privileged: true\n```\n\nRun through the Action, this produces a fake error annotation and folds the remaining log lines, including the FAIL verdict, into a collapsed group.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.31.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"60c091c7cc8f86c6b0c5954031097364fea0a201"},{"fixed":"a6a7a76736de1c72abfa96c41ff8af556ffdc55f"}]}],"versions":["v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.2","v0.15.1","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.7","v0.3.6","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}},{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123369"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/918"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:56:59Z","nvd_published_at":"2026-11-09T18:17:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]} \ No newline at end of file diff --git a/data/Go/GO-2026-6848.json b/data/Go/GO-2026-6848.json new file mode 100644 index 0000000000..56a36a634b --- /dev/null +++ b/data/Go/GO-2026-6848.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6848","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.770362892Z","aliases":["CVE-2026-97043"],"summary":"Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile","details":"Building a malicious package that uses cgo could bypass \"#cgo LDFLAGS\" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in \"//go:cgo_ldflag\" directives.\n\nWhen \"cmd/cgo\" generates \"_cgo_gotypes.go\", it quotes each \"#cgo LDFLAGS\" argument with strconv.Quote in a \"//go:cgo_ldflag\" directive, but \"cmd/compile\" and \"cmd/go\" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice.\n\n\"cmd/compile\" and \"cmd/go\" now properly handle backslash-escaped quotes and unquote \"//go:cgo_*\" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"},{"path":"cmd/compile"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6848.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862156"},{"type":"REPORT","url":"https://go.dev/issue/82567"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6848"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6849.json b/data/Go/GO-2026-6849.json new file mode 100644 index 0000000000..0f47aadbb3 --- /dev/null +++ b/data/Go/GO-2026-6849.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6849","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.799110962Z","aliases":["CVE-2026-97042"],"summary":"Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link","details":"Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.\n\nThe compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk.\n\nThe compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/cgo"},{"path":"cmd/compile"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6849.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862155"},{"type":"REPORT","url":"https://go.dev/issue/82568"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6849"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6850.json b/data/Go/GO-2026-6850.json new file mode 100644 index 0000000000..2baf99f44e --- /dev/null +++ b/data/Go/GO-2026-6850.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6850","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.803931428Z","aliases":["CVE-2026-97041"],"summary":"Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link","details":"Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.\n\nThe compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments.\n\nThe compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/compile"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6850.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862154"},{"type":"REPORT","url":"https://go.dev/issue/82569"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6850"},"credits":[{"name":"RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]} \ No newline at end of file diff --git a/data/Go/GO-2026-6851.json b/data/Go/GO-2026-6851.json new file mode 100644 index 0000000000..27df30c830 --- /dev/null +++ b/data/Go/GO-2026-6851.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6851","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.815322039Z","aliases":["CVE-2026-97040"],"summary":"Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link","details":"Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking.\n\nWhen loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds.\n\nThe linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"},{"path":"cmd/link"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6851.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862153"},{"type":"REPORT","url":"https://go.dev/issue/82570"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6851"},"credits":[{"name":"RyotaK (https://ryotak.net) of GMO Flatt Security Inc."}]} \ No newline at end of file diff --git a/data/Go/GO-2026-6852.json b/data/Go/GO-2026-6852.json new file mode 100644 index 0000000000..2061111169 --- /dev/null +++ b/data/Go/GO-2026-6852.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6852","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.802903591Z","aliases":["CVE-2026-97039"],"summary":"Flag sanitization bypass via \"#cgo pkg-config:\" directives in cmd/go","details":"Building a malicious package that uses \"#cgo pkg-config:\" directives could load untrusted pkg-config \".pc\" files or inject unvalidated compiler and linker flags.\n\nThe pkg-config flag allowlist previously permitted \"--with-path=\" and \"--personality=\", allowed \"--define-variable=\" values beginning with \"=\" or \"$\" (which can rewrite paths in system \".pc\" files into sysroot-prefixed \"-L=\" or \"-L$SYSROOT\" linker search paths), and allowed package arguments ending in \".pc\" or containing path separators or \"..\", which caused pkg-config to load local \".pc\" files directly from the package directory. In addition, flags returned by \"pkg-config --cflags\" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.\n\nThe go command now disallows \"--with-path=\", \"--personality=\", leading \"=\" or \"$\" characters in \"--define-variable=\" values, and local \".pc\" paths in \"#cgo pkg-config:\" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6852.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862152"},{"type":"REPORT","url":"https://go.dev/issue/82571"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6852"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6853.json b/data/Go/GO-2026-6853.json new file mode 100644 index 0000000000..89c7bfe15a --- /dev/null +++ b/data/Go/GO-2026-6853.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6853","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.801899979Z","aliases":["CVE-2026-97038"],"summary":"Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go","details":"Building a malicious package containing \".syso\" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.\n\nLinker input files—including \".syso\" files, direct object or library inputs in \"#cgo LDFLAGS\", and libraries in \"-L\" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or \".syso\" files (or loaded via \"-l:\" or \"-l\" containing path separators), injecting unallowlisted linker flags via PE/COFF \".drectve\" sections on Windows or Mach-O \"LC_LINKER_OPTION\" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.\n\nThe go command now verifies that \".syso\" files, direct linker inputs, and libraries in \"-L\" directories are valid binary objects or archives that do not contain unallowlisted \".drectve\" directives, \"LC_LINKER_OPTION\" load commands, or LTO IR sections, and disallows \"-l:\" and \":\", \"=\", or path separators in \"-l\" flags.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6853.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862151"},{"type":"REPORT","url":"https://go.dev/issue/82572"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6853"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6854.json b/data/Go/GO-2026-6854.json new file mode 100644 index 0000000000..7addd4c0d9 --- /dev/null +++ b/data/Go/GO-2026-6854.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6854","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.799312883Z","aliases":["CVE-2026-97037"],"summary":"Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go","details":"Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\".\n\nSplit \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.\n\nThe go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\".","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6854.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862150"},{"type":"REPORT","url":"https://go.dev/issue/82573"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6854"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6855.json b/data/Go/GO-2026-6855.json new file mode 100644 index 0000000000..76d69812b0 --- /dev/null +++ b/data/Go/GO-2026-6855.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6855","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:15.677114364Z","aliases":["CVE-2026-97036"],"summary":"Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go","details":"On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library \" in a \"#cgo LDFLAGS\" directive.\n\nThe Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time.\n\nThe go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"goos":["darwin"],"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6855.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862149"},{"type":"REPORT","url":"https://go.dev/issue/82574"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6855"},"credits":[{"name":"Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)"}]} \ No newline at end of file diff --git a/data/Go/GO-2026-6856.json b/data/Go/GO-2026-6856.json new file mode 100644 index 0000000000..d177f7a4d7 --- /dev/null +++ b/data/Go/GO-2026-6856.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6856","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:15.719402274Z","aliases":["CVE-2026-97035"],"summary":"Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go","details":"When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via \"-gen-*\" or \"-gnat*\" flags in \"#cgo\" directives.\n\nThe \"-g*\" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument \"-gen-cdb-fragment-path \" flag and GCC's two-argument \"-gnatO \" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.\n\n\"-gen-*\" and \"-gnat*\" flags are now disallowed in \"#cgo\" compiler and linker flags.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6856.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862148"},{"type":"REPORT","url":"https://go.dev/issue/82575"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6856"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6857.json b/data/Go/GO-2026-6857.json new file mode 100644 index 0000000000..96a7f1729a --- /dev/null +++ b/data/Go/GO-2026-6857.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6857","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.793749820Z","aliases":["CVE-2026-97034"],"summary":"Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go","details":"When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\").\n\nWhen linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC's built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\".\n\nThe go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6857.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862147"},{"type":"REPORT","url":"https://go.dev/issue/82576"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6857"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6858.json b/data/Go/GO-2026-6858.json new file mode 100644 index 0000000000..7509224d54 --- /dev/null +++ b/data/Go/GO-2026-6858.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6858","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.803158957Z","aliases":["CVE-2026-97033"],"summary":"Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go","details":"Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in \"#cgo\" directives.\n\nSpecifically, \"--sysroot\" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; \"-target\" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; \"-isysroot\" and \"-Wl,-syslibroot\" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and \"-x\" permitted specifying arbitrary compiler input languages beyond those supported by cgo.\n\n\"--sysroot\" and \"-target\" are now disallowed in \"#cgo\" flags, \"-isysroot\" and \"-Wl,-syslibroot\" are verified not to point to regular files, and \"-x\" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6858.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862146"},{"type":"REPORT","url":"https://go.dev/issue/82577"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6858"}} \ No newline at end of file diff --git a/data/Go/GO-2026-6859.json b/data/Go/GO-2026-6859.json new file mode 100644 index 0000000000..4e7bb40390 --- /dev/null +++ b/data/Go/GO-2026-6859.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GO-2026-6859","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:14.805898236Z","aliases":["CVE-2026-97054"],"summary":"HTTP/1 server crash due to MaxBytesReader header race in net/http","details":"For HTTP/1 servers, when MaxBytesReader's limit is exceeded, \"Connection: close\" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.","affected":[{"package":{"name":"stdlib","ecosystem":"Go","purl":"pkg:golang/stdlib"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"net/http","symbols":["CanonicalHeaderKey","Client.CloseIdleConnections","Client.Do","Client.Get","Client.Head","Client.Post","Client.PostForm","ClientConn.Close","ClientConn.RoundTrip","Cookie.String","Cookie.Valid","CrossOriginProtection.AddInsecureBypassPattern","CrossOriginProtection.AddTrustedOrigin","CrossOriginProtection.Check","Dir.Open","Error","Get","Handle","HandleFunc","HandlerFunc.ServeHTTP","Head","Header.Add","Header.Del","Header.Get","Header.Set","Header.Values","Header.Write","Header.WriteSubset","ListenAndServe","ListenAndServeTLS","NewRequest","NewRequestWithContext","NotFound","ParseCookie","ParseSetCookie","ParseTime","Post","PostForm","ProxyFromEnvironment","ReadRequest","ReadResponse","Redirect","Request.AddCookie","Request.BasicAuth","Request.Cookie","Request.Cookies","Request.CookiesNamed","Request.FormFile","Request.FormValue","Request.MultipartReader","Request.ParseForm","Request.ParseMultipartForm","Request.PostFormValue","Request.Referer","Request.SetBasicAuth","Request.UserAgent","Request.Write","Request.WriteProxy","Response.Cookies","Response.Location","Response.Write","ResponseController.EnableFullDuplex","ResponseController.Flush","ResponseController.Hijack","ResponseController.SetReadDeadline","ResponseController.SetWriteDeadline","Serve","ServeContent","ServeFile","ServeFileFS","ServeMux.Handle","ServeMux.HandleFunc","ServeMux.ServeHTTP","ServeTLS","Server.Close","Server.ListenAndServe","Server.ListenAndServeTLS","Server.Serve","Server.ServeTLS","Server.SetKeepAlivesEnabled","Server.Shutdown","SetCookie","Transport.CancelRequest","Transport.Clone","Transport.CloseIdleConnections","Transport.NewClientConn","Transport.RoundTrip","body.Close","body.Read","bodyEOFSignal.Close","bodyEOFSignal.Read","bodyLocked.Read","bufioFlushWriter.Write","cancelTimerBody.Close","cancelTimerBody.Read","checkConnErrorWriter.Write","chunkWriter.Write","connReader.Read","connectMethodKey.String","expectContinueReader.Close","expectContinueReader.Read","extraHeader.Write","fileHandler.ServeHTTP","fileTransport.RoundTrip","globalOptionsHandler.ServeHTTP","gzipReader.Close","gzipReader.Read","http1ClientConn.Close","http1ClientConn.RoundTrip","http2ClientConn.RoundTrip","http2Handler.ServeHTTP","http2ResponseWriter.Flush","http2ResponseWriter.FlushError","http2ResponseWriter.Push","http2RoundTripper.RoundTrip","http3ServerHandler.ServeHTTP","initALPNRequest.ServeHTTP","loggingConn.Close","loggingConn.Read","loggingConn.Write","maxBytesReader.Close","maxBytesReader.Read","onceCloseListener.Close","persistConn.Read","persistConnWriter.ReadFrom","persistConnWriter.Write","populateResponse.Write","populateResponse.WriteHeader","readTrackingBody.Close","readTrackingBody.Read","readWriteCloserBody.CloseWrite","readWriteCloserBody.Read","redirectHandler.ServeHTTP","response.Flush","response.FlushError","response.Hijack","response.ReadFrom","response.Write","response.WriteHeader","response.WriteString","serverHandler.ServeHTTP","socksDialer.DialWithConn","socksUsernamePassword.Authenticate","stringWriter.WriteString","timeoutHandler.ServeHTTP","timeoutWriter.Write","timeoutWriter.WriteHeader","transportReadFromServerError.Error","unencryptedHTTP2Request.ServeHTTP"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6859.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862185"},{"type":"REPORT","url":"https://go.dev/issue/82563"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6859"},"credits":[{"name":"Jakub Ciolek (https://ciolek.dev)"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-3893-7fxc-qvff.json b/data/NuGet/GHSA-3893-7fxc-qvff.json new file mode 100644 index 0000000000..7af2819f15 --- /dev/null +++ b/data/NuGet/GHSA-3893-7fxc-qvff.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-3893-7fxc-qvff","published":"2026-11-11T00:28:01Z","modified":"2026-11-11T00:45:08.240188050Z","aliases":["CVE-2026-114154"],"summary":"Microsoft Security Advisory CVE-2026-114154 - ASP.NET Core Denial of Service Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core. This advisory provides guidance on updating affected applications and components.\n\nMalformed chunked HttpSys requests containing conflicting content-length headers can retain request and connection resources.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/513\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-401\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** All\n\n## Affected Packages\n\nThe tables list affected version ranges and fixed package versions. Runtime and standalone deliveries are listed separately.\n\n### ASP.NET Core 2.3 - standalone packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.10 | 2.3.14\n[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.11 | 2.3.14\n[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.12 | 2.3.14\n[Microsoft.AspNetCore.Server.HttpSys](https://www.nuget.org/packages/Microsoft.AspNetCore.Server.HttpSys) | = 2.3.13 | 2.3.14\n\n### .NET 8.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 8.0.0, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 8.0.0, <= 8.0.33 | 8.0.34\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 8.0.0, <= 8.0.33 | 8.0.34\n\n### .NET 9.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 9.0.0, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 9.0.0, <= 9.0.22 | 9.0.23\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 9.0.0, <= 9.0.22 | 9.0.23\n\n### .NET 10.0 - affected runtime packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.AspNetCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64) | >= 10.0.0, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64) | >= 10.0.0, <= 10.0.14 | 10.0.15\n[Microsoft.AspNetCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86) | >= 10.0.0, <= 10.0.14 | 10.0.15\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nCheck the deployed runtime and application package versions against the affected ranges above. Self-contained applications include their own runtime; updating a machine-wide runtime does not replace it.\n\n### How do I fix the issue?\n\nUpdate standalone Microsoft.AspNetCore.Server.HttpSys references to 2.3.14, then rebuild and redeploy affected applications, including framework-dependent applications. Install the applicable patched runtime version listed above. Restart applications. Rebuild and redeploy self-contained applications; updating a machine-wide runtime does not replace their embedded runtime. An SDK update alone does not update an application's standalone package references.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114154](https://www.cve.org/CVERecord?id=CVE-2026-114154)\n\n### Acknowledgements\n\n- [Kevin Gosse](https://x.com/kookiz/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.10"},{"fixed":"2.3.14"}]}],"versions":["2.3.10","2.3.11","2.3.12","2.3.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.11"},{"fixed":"2.3.14"}]}],"versions":["2.3.11","2.3.12","2.3.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.12"},{"fixed":"2.3.14"}]}],"versions":["2.3.12","2.3.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.Server.HttpSys","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.Server.HttpSys"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.13"},{"fixed":"2.3.14"}]}],"versions":["2.3.13"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"last_known_affected_version_range":"<= 8.0.33","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"<= 9.0.22","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}},{"package":{"name":"Microsoft.AspNetCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.AspNetCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"last_known_affected_version_range":"<= 10.0.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3893-7fxc-qvff/GHSA-3893-7fxc-qvff.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/security/advisories/GHSA-3893-7fxc-qvff"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/513"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/20e629e9af9cabb0c1c02410be99521821b22f83"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/8cb8dc4a1d3e5a6aedeb3dbbfd0b390aac59f172"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/commit/efc799e69e38cdc36c7b9c96580014d28e68201c"},{"type":"PACKAGE","url":"https://github.com/dotnet/aspnetcore"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/discussions/70474"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/aspnetcore/releases/tag/v9.0.23"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114154"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/cve-2026-114154"}],"database_specific":{"cwe_ids":["CWE-401"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:28:01Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-3cgx-w6gm-fqrx.json b/data/NuGet/GHSA-3cgx-w6gm-fqrx.json new file mode 100644 index 0000000000..2d82d7cc9a --- /dev/null +++ b/data/NuGet/GHSA-3cgx-w6gm-fqrx.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-3cgx-w6gm-fqrx","published":"2026-11-11T00:32:59Z","modified":"2026-11-11T00:45:08.698315642Z","aliases":["CVE-2026-114159"],"summary":"Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nAn oversized Portable PDB document name can be truncated during allocation and cause a heap out-of-bounds write.\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-122\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** x86, x64, Arm64\n\n## Affected Packages\n\nMicrosoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a Portable PDB containing an oversized document name. The Windows runtime's native stack-trace reader can reach this initialization through its native-reader fallback.\n\n### .NET on Windows\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34\n.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23\n.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15\n.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows runtime packages for self-contained applications\n\nThe following packages deliver the affected .NET native reader. Exposure requires the PDB-reading operation described above; the presence of the reader does not make every application or symbol-reading path vulnerable.\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows SDK updates\n\nThe following SDK updates include the corrected .NET runtime. Update each installed Windows SDK feature band:\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx on Windows | >= 8.0.100-0, < 8.0.134 | 8.0.134\n.NET SDK 8.0.4xx on Windows | >= 8.0.400-0, < 8.0.428 | 8.0.428\n.NET SDK 9.0.1xx on Windows | >= 9.0.100-0, < 9.0.124 | 9.0.124\n.NET SDK 9.0.3xx on Windows | >= 9.0.300-0, < 9.0.321 | 9.0.321\n.NET SDK 10.0.1xx on Windows | >= 10.0.100-0, < 10.0.115 | 10.0.115\n.NET SDK 10.0.4xx on Windows | >= 10.0.400-0, < 10.0.404 | 10.0.404\n.NET SDK 11.0.1xx on Windows | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nApplications using Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed above to initialize the native reader with a Portable PDB containing an oversized document name are exposed on Windows x86, x64, and Arm64. The Windows runtime's native stack-trace reader can reach this initialization when PE metadata selects its native-reader fallback. See [affected packages](#affected-packages) for the affected .NET products on Windows.\n\n### How do I fix the issue?\n\nUpdate affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.\n\nFor applications that deploy their own .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.\n\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/521\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114159](https://www.cve.org/CVERecord?id=CVE-2026-114159)\n\n### Acknowledgements\n\n- [h4urek](https://x.com/h4urek) with [secsys lab](https://secsys.fudan.edu.cn/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3cgx-w6gm-fqrx/GHSA-3cgx-w6gm-fqrx.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-3cgx-w6gm-fqrx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114159"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/521"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137296"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://github.com/dotnet/core/releases/tag/v11.0.0"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114159"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:32:59Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-6856-87hx-p5x7.json b/data/NuGet/GHSA-6856-87hx-p5x7.json new file mode 100644 index 0000000000..112be0c37e --- /dev/null +++ b/data/NuGet/GHSA-6856-87hx-p5x7.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-6856-87hx-p5x7","published":"2026-11-11T00:39:12Z","modified":"2026-11-11T01:00:53.377262861Z","summary":"Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nThe VSTest artifact postprocessor can consume a forged `executionComplete.json` from another local user and execute attacker-controlled output handling.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/517\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.5 (base score)\n- **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-284\n\n## Affected Platforms\n\n- **Platforms:** Windows, Linux, macOS\n- **Architectures:** All\n\n## Affected Packages\n\nThe tables list affected versions of Microsoft.TestPlatform.CLI and their patched versions. The VSTest CLI is also bundled in the .NET SDK; SDK versions are listed separately below. Updating a separately installed CLI package does not replace the SDK-bundled test runner.\n\nMicrosoft.TestPlatform.CLI is affected starting with 17.2.0-preview-20220301-01, including the first stable release, 17.2.0. Use a patched version listed below for a compatible servicing line.\n\n### VSTest NuGet package\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | >= 17.2.0-preview-20220301-01, < 17.3.0 | 17.3.4\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.3.0 | 17.3.4\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.3.1 | 17.3.4\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.3.2 | 17.3.4\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.3.3 | 17.3.4\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.8.0 | 17.8.1\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.11.0 | 17.11.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.11.1 | 17.11.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.12.0 | 17.12.1\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.14.0 | 17.14.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.14.1 | 17.14.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.0.0 | 18.0.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.0.1 | 18.0.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.7.0 | 18.7.1\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.10.0 | 18.10.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.10.1 | 18.10.2\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.11.0 | 18.11.1\n\nStable 18.10.1 remains affected; use Microsoft.TestPlatform.CLI 18.10.2 on that servicing line.\n\n### Other affected VSTest NuGet versions\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.4.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.4.1 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.5.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.6.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.6.1 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.6.2 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.6.3 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.7.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.7.1 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.7.2 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.9.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.10.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 17.13.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.3.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.4.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.5.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.5.1 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.6.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.8.0 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.8.1 | Use a compatible patched version listed above\n[Microsoft.TestPlatform.CLI](https://www.nuget.org/packages/Microsoft.TestPlatform.CLI) | = 18.9.0 | Use a compatible patched version listed above\n\nThese releases have no same-line fixed package in this update. Move to a compatible fixed servicing line listed above.\n\n### Affected VSTest prerelease versions\n\nThe following table applies to Microsoft.TestPlatform.CLI.\n\nAffected version | Patched version\n--- | ---\n= 17.3.0-preview-20220426-02 | Use a compatible patched version listed above\n= 17.3.0-preview-20220530-08 | Use a compatible patched version listed above\n= 17.3.0-preview-20220612-01 | Use a compatible patched version listed above\n= 17.4.0-preview-20220707-01 | Use a compatible patched version listed above\n= 17.4.0-preview-20220726-02 | Use a compatible patched version listed above\n= 17.4.0-preview-20221003-03 | Use a compatible patched version listed above\n= 17.4.0-release-20220926-01 | Use a compatible patched version listed above\n= 17.5.0-preview-20221003-04 | Use a compatible patched version listed above\n= 17.5.0-preview-20221221-03 | Use a compatible patched version listed above\n= 17.6.0-preview-20230223-05 | Use a compatible patched version listed above\n= 17.7.0-preview-23364-03 | Use a compatible patched version listed above\n= 17.7.0-preview.23280.1 | Use a compatible patched version listed above\n= 17.8.0-preview-23371-04 | Use a compatible patched version listed above\n= 17.8.0-preview-23424-02 | Use a compatible patched version listed above\n= 17.8.0-release-23468-02 | Use a compatible patched version listed above\n= 17.9.0-preview-23503-02 | Use a compatible patched version listed above\n= 17.9.0-preview-23531-01 | Use a compatible patched version listed above\n= 17.9.0-preview-23577-04 | Use a compatible patched version listed above\n= 17.9.0-release-23619-01 | Use a compatible patched version listed above\n= 17.10.0-preview-24080-01 | Use a compatible patched version listed above\n= 17.10.0-release-24177-07 | Use a compatible patched version listed above\n= 17.11.0-release-24352-06 | Use a compatible patched version listed above\n= 17.11.0-release-24373-02 | Use a compatible patched version listed above\n= 17.14.0-preview-25107-01 | Use a compatible patched version listed above\n\n### Fixed .NET SDK deliveries\n\nPackage | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx | >= 8.0.100, <= 8.0.133 | 8.0.134 (bundled VSTest: 17.8.1-hotfix-26528-33)\n.NET SDK 8.0.4xx | >= 8.0.400, <= 8.0.427 | 8.0.428 (bundled VSTest: 17.11.2-hotfix-26528-32)\n.NET SDK 9.0.1xx | >= 9.0.100, <= 9.0.123 | 9.0.124 (bundled VSTest: 17.12.1-hotfix-26528-39)\n.NET SDK 9.0.3xx | >= 9.0.300, <= 9.0.320 | 9.0.321 (bundled VSTest: 17.14.2-hotfix-26528-35)\n.NET SDK 10.0.1xx | >= 10.0.100, <= 10.0.114 | 10.0.115 (bundled VSTest: 18.0.2-hotfix-26529-108)\n.NET SDK 10.0.4xx | >= 10.0.400, <= 10.0.403 | 10.0.404 (bundled VSTest: 18.7.1-hotfix-26529-119)\n.NET SDK 11.0.1xx | >= 11.0.100-preview.1.26104.118, <= 11.0.100-rc.3.26522.148 | 11.0.100 (bundled VSTest: 18.12.0-hotfix-26529-118)\n\nEarlier SDKs in these serviced feature bands must be updated. The first .NET 11 general-availability SDK is fixed; its earlier preview and release-candidate SDKs require an update to 11.0.100.\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nCheck the version of Microsoft.TestPlatform.CLI used by your standalone VSTest installation.\n\nRun `dotnet --list-sdks` to list installed SDKs and `dotnet --version` from the project directory to identify the selected SDK, including any `global.json` selection.\n\n### How do I fix the issue?\n\nFor standalone VSTest CLI installations, replace Microsoft.TestPlatform.CLI with its patched version listed above. For releases without a same-line fix, use a compatible fixed servicing line listed above.\n\nInstall a fixed SDK listed above and ensure test invocations select it. Updating a separately installed CLI package does not replace VSTest embedded in an older SDK.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the VSTest repository at https://github.com/microsoft/vstest. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-105544](https://www.cve.org/CVERecord?id=CVE-2026-105544)\n\n### Acknowledgements\n\n- [Weeraphat Srisutham](https://linkedin.com/in/weeraphat-srisutham)\n- [Ky0toFu](https://x.com/ky0tofu)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.2.0-preview-20220301-01"},{"fixed":"17.3.4"}]}],"versions":["17.2.0","17.2.0-preview-20220301-01","17.2.0-preview-20220401-07","17.2.0-preview-20220401-08","17.2.1","17.3.0","17.3.0-preview-20220426-02","17.3.0-preview-20220530-08","17.3.0-preview-20220612-01","17.3.1","17.3.2","17.3.3"],"database_specific":{"last_known_affected_version_range":"< 17.3.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.1"},{"fixed":"17.3.4"}]}],"versions":["17.3.1","17.3.2","17.3.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.2"},{"fixed":"17.3.4"}]}],"versions":["17.3.2","17.3.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.3"},{"fixed":"17.3.4"}]}],"versions":["17.3.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.8.0"},{"fixed":"17.8.1"}]}],"versions":["17.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.11.0"},{"fixed":"17.11.2"}]}],"versions":["17.11.0","17.11.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.11.1"},{"fixed":"17.11.2"}]}],"versions":["17.11.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.12.0"},{"fixed":"17.12.1"}]}],"versions":["17.12.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.14.0"},{"fixed":"17.14.2"}]}],"versions":["17.14.0","17.14.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.14.1"},{"fixed":"17.14.2"}]}],"versions":["17.14.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"18.0.2"}]}],"versions":["18.0.0","18.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.1"},{"fixed":"18.0.2"}]}],"versions":["18.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.7.0"},{"fixed":"18.7.1"}]}],"versions":["18.7.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.10.0"},{"fixed":"18.10.2"}]}],"versions":["18.10.0","18.10.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.10.1"},{"fixed":"18.10.2"}]}],"versions":["18.10.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.11.0"},{"fixed":"18.11.1"}]}],"versions":["18.11.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.6.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.6.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.6.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.7.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.7.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.7.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.10.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.13.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.8.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["18.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.0-preview-20220707-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.0-preview-20220726-02"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.0-preview-20221003-03"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.4.0-release-20220926-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.5.0-preview-20221003-04"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.5.0-preview-20221221-03"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.6.0-preview-20230223-05"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.7.0-preview-23364-03"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.7.0-preview.23280.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.8.0-preview-23371-04"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.8.0-preview-23424-02"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.8.0-release-23468-02"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.9.0-preview-23503-02"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.9.0-preview-23531-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.9.0-preview-23577-04"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.9.0-release-23619-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.10.0-preview-24080-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.10.0-release-24177-07"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.11.0-release-24352-06"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.11.0-release-24373-02"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"versions":["17.14.0-preview-25107-01"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}},{"package":{"name":"Microsoft.TestPlatform.CLI","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.TestPlatform.CLI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.3.0"},{"fixed":"17.3.4"}]}],"versions":["17.3.0","17.3.1","17.3.2","17.3.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6856-87hx-p5x7/GHSA-6856-87hx-p5x7.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/vstest/security/advisories/GHSA-6856-87hx-p5x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105544"},{"type":"WEB","url":"https://github.com/microsoft/vstest/issues/16654"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/517"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v10.0.115"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v10.0.404"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v11.0.100"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v8.0.134"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v8.0.428"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v9.0.124"},{"type":"WEB","url":"https://github.com/dotnet/sdk/releases/tag/v9.0.321"},{"type":"PACKAGE","url":"https://github.com/microsoft/vstest"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-105544"}],"database_specific":{"cwe_ids":["CWE-284"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:39:12Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-6rff-vv3p-7mrw.json b/data/NuGet/GHSA-6rff-vv3p-7mrw.json new file mode 100644 index 0000000000..565a4530bd --- /dev/null +++ b/data/NuGet/GHSA-6rff-vv3p-7mrw.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-6rff-vv3p-7mrw","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T00:45:04.075864219Z","withdrawn":"2026-11-11T00:32:10Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114159 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3cgx-w6gm-fqrx. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6rff-vv3p-7mrw/GHSA-6rff-vv3p-7mrw.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114159"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114159"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:32:10Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-cfv6-4v53-fff6.json b/data/NuGet/GHSA-cfv6-4v53-fff6.json new file mode 100644 index 0000000000..8b5b070fca --- /dev/null +++ b/data/NuGet/GHSA-cfv6-4v53-fff6.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-cfv6-4v53-fff6","published":"2026-11-10T21:33:10Z","modified":"2026-11-11T01:00:31.824270939Z","withdrawn":"2026-11-11T00:39:56Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-x8x8-p968-x646. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cfv6-4v53-fff6/GHSA-cfv6-4v53-fff6.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118745"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:39:56Z","nvd_published_at":"2026-11-10T19:19:51Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-cjjx-gv54-83qh.json b/data/NuGet/GHSA-cjjx-gv54-83qh.json new file mode 100644 index 0000000000..e32f3360d4 --- /dev/null +++ b/data/NuGet/GHSA-cjjx-gv54-83qh.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-cjjx-gv54-83qh","published":"2026-11-10T21:32:52Z","modified":"2026-11-11T00:45:03.751293279Z","withdrawn":"2026-11-11T00:34:02Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r8h3-p8p6-ggp7. This link is maintained to preserve external references.\n\n## Original Description\nHeap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cjjx-gv54-83qh/GHSA-cjjx-gv54-83qh.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114158"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114158"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:34:02Z","nvd_published_at":"2026-11-10T19:19:09Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-fpxj-5c99-g7vj.json b/data/NuGet/GHSA-fpxj-5c99-g7vj.json new file mode 100644 index 0000000000..2e286b87da --- /dev/null +++ b/data/NuGet/GHSA-fpxj-5c99-g7vj.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-fpxj-5c99-g7vj","published":"2026-11-11T00:35:02Z","modified":"2026-11-11T00:45:08.658887607Z","aliases":["CVE-2026-114151"],"summary":"Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nA crafted PDB `LF_DECIMAL` payload can trigger an out-of-bounds stack write when processed by DIA.\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-502, CWE-121\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** x86, x64, Arm64\n\n## Affected Packages\n\nMicrosoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading constants from attacker-supplied PDBs through `ISymUnmanagedConstant.GetValue`. The .NET runtime's native stack-trace reading path does not call `ISymUnmanagedConstant.GetValue`. This excludes that invocation, not the .NET product as a whole.\n\n### .NET on Windows\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34\n.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23\n.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15\n.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows self-contained runtime packs\n\nThese runtime packs deliver the .NET runtime for Windows self-contained applications.\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows SDK distributions\n\nThese Windows SDK distributions are affected through their bundled .NET runtime.\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134\n.NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428\n.NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124\n.NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321\n.NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115\n.NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404\n.NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100\n\n### Windows SDK updates\n\nUpdate each installed SDK feature band to the following version or later:\n\n- .NET SDK 8.0.1xx: 8.0.134\n- .NET SDK 8.0.4xx: 8.0.428\n- .NET SDK 9.0.1xx: 9.0.124\n- .NET SDK 9.0.3xx: 9.0.321\n- .NET SDK 10.0.1xx: 10.0.115\n- .NET SDK 10.0.4xx: 10.0.404\n- .NET SDK 11.0.1xx: 11.0.100\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nApplications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 to read constants from attacker-supplied PDBs through `ISymUnmanagedConstant.GetValue` are exposed on x86, x64, and Arm64. The .NET runtime's native stack-trace reading path does not call `ISymUnmanagedConstant.GetValue`. This excludes that invocation, not the .NET product as a whole. See [affected packages](#affected-packages) for the affected .NET products on Windows.\n\n### How do I fix the issue?\n\nUpdate affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.\n\nMicrosoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114151](https://www.cve.org/CVERecord?id=CVE-2026-114151)\n\n### Acknowledgements\n\n- 41ae55e9310ff27fa6f26af4727e5590\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fpxj-5c99-g7vj/GHSA-fpxj-5c99-g7vj.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-fpxj-5c99-g7vj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114151"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/498"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/522"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137280"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/dotnet/releases/tag/v11.0.0"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151"}],"database_specific":{"cwe_ids":["CWE-121","CWE-502"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:35:02Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-hm4p-mv9w-4w8f.json b/data/NuGet/GHSA-hm4p-mv9w-4w8f.json new file mode 100644 index 0000000000..608c054a4f --- /dev/null +++ b/data/NuGet/GHSA-hm4p-mv9w-4w8f.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-hm4p-mv9w-4w8f","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T01:00:31.771669003Z","withdrawn":"2026-11-11T00:39:39Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-xf35-v9jh-g65w. This link is maintained to preserve external references.\n\n## Original Description\nStack-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hm4p-mv9w-4w8f/GHSA-hm4p-mv9w-4w8f.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114152"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114152"}],"database_specific":{"cwe_ids":["CWE-121"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:39:39Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-m63f-xhvm-6mv5.json b/data/NuGet/GHSA-m63f-xhvm-6mv5.json new file mode 100644 index 0000000000..8be282f27a --- /dev/null +++ b/data/NuGet/GHSA-m63f-xhvm-6mv5.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-m63f-xhvm-6mv5","published":"2026-11-11T00:30:06Z","modified":"2026-11-11T00:45:04.314908859Z","aliases":["CVE-2026-120778"],"summary":"Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.\n\nAn insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/519\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.3\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-379 (Creation of Temporary File in Directory with Insecure Permissions)\n- **MSRC severity:** Important\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** x64, Arm64\n\n## Affected Packages\n\n### Standalone Aspire CLI\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Aspire.Cli](https://www.nuget.org/packages/Aspire.Cli) | >= 13.2.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-x64](https://www.nuget.org/packages/Aspire.Cli.linux-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-arm64](https://www.nuget.org/packages/Aspire.Cli.linux-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-musl-x64](https://www.nuget.org/packages/Aspire.Cli.linux-musl-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-x64](https://www.nuget.org/packages/Aspire.Cli.osx-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-arm64](https://www.nuget.org/packages/Aspire.Cli.osx-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n\n### Aspire CLI npm packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[@microsoft/aspire-cli](https://www.npmjs.com/package/@microsoft/aspire-cli) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-musl-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-musl-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n\nThe affected scenario concerns CLI-generated server and integration builds on non-Windows systems when a local attacker can influence automatic MSBuild response-file discovery through an attacker-writable directory. This includes builds started by `aspire sdk generate`, `aspire sdk dump`, and `aspire sdk export`.\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nThe reported scenario involves a local attacker influencing a generated build through a shared temporary-directory ancestor while another user invokes the Aspire CLI. Versions 13.2.0 through 13.6.4 are affected.\n\nAspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire CLI has been updated.\n\n### How do I fix the issue?\n\nUpdate the Aspire CLI to version 13.6.5 or later. If installed as a .NET tool, update the Aspire.Cli package. If installed using npm, update @microsoft/aspire-cli to version 13.6.5 or later; its platform-specific dependency must also resolve to version 13.6.5 or later. Otherwise update the CLI through its installation method.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the [Aspire repository](https://github.com/microsoft/aspire).\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120778](https://www.cve.org/CVERecord?id=CVE-2026-120778)\n\n### Acknowledgements\n\n- l8BL with [ENKI WhiteHat](https://enki.co.kr/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"},{"fixed":"13.6.5"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-musl-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-musl-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-m63f-xhvm-6mv5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/519"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22101"},{"type":"WEB","url":"https://github.com/microsoft/aspire/pull/22071"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/1ecd7cc70b5a5a5b8571fe3af69faa1646b8de47"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"database_specific":{"cwe_ids":["CWE-379"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:30:06Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-mqcg-252r-5fj7.json b/data/NuGet/GHSA-mqcg-252r-5fj7.json new file mode 100644 index 0000000000..7f0ec53ba6 --- /dev/null +++ b/data/NuGet/GHSA-mqcg-252r-5fj7.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-mqcg-252r-5fj7","published":"2026-11-10T21:32:51Z","modified":"2026-11-11T00:45:03.946197977Z","withdrawn":"2026-11-11T00:34:51Z","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references.\n\n## Original Description\nDeserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.34","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"last_known_affected_version_range":"< 8.0.34","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-mqcg-252r-5fj7/GHSA-mqcg-252r-5fj7.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114151"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151"}],"database_specific":{"cwe_ids":["CWE-121"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:34:51Z","nvd_published_at":"2026-11-10T19:19:08Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-q6jf-24jf-m3cg.json b/data/NuGet/GHSA-q6jf-24jf-m3cg.json new file mode 100644 index 0000000000..5ee480d06e --- /dev/null +++ b/data/NuGet/GHSA-q6jf-24jf-m3cg.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-q6jf-24jf-m3cg","published":"2026-11-11T00:31:23Z","modified":"2026-11-11T00:45:04.289567958Z","aliases":["CVE-2026-120792"],"summary":"Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.\n\nInsecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/518\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.3\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L`\n- **Weakness:** CWE-532 (Insertion of Sensitive Information into Log File)\n- **MSRC severity:** Important\n- **Impact:** Information Disclosure\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** x64, Arm64\n\n## Affected Packages\n\n### Standalone Aspire CLI\n\nPackage | Affected version | Patched version\n--- | --- | ---\nAspire CLI ([Aspire.Cli](https://www.nuget.org/packages/Aspire.Cli)) | >= 13.2.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-x64](https://www.nuget.org/packages/Aspire.Cli.linux-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-arm64](https://www.nuget.org/packages/Aspire.Cli.linux-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-musl-x64](https://www.nuget.org/packages/Aspire.Cli.linux-musl-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-x64](https://www.nuget.org/packages/Aspire.Cli.osx-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-arm64](https://www.nuget.org/packages/Aspire.Cli.osx-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n\n### Aspire CLI npm packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[@microsoft/aspire-cli](https://www.npmjs.com/package/@microsoft/aspire-cli) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-musl-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-musl-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n\nThe affected component is the Aspire CLI's deprecated MCP configuration scanner, which ships in the CLI packages listed above. Its temporary-file diagnostics can include configuration content and use a fixed path in a shared temporary directory.\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nThe reported scenario involves running Aspire CLI agent or MCP initialization commands on a non-Windows system with a temporary directory shared by multiple users. Versions 13.2.0 through 13.6.4 are affected.\n\nAspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire CLI has been updated.\n\n### How do I fix the issue?\n\nUpdate the Aspire CLI to version 13.6.5 or later. If installed as a .NET tool, update the Aspire.Cli package. If installed using npm, update @microsoft/aspire-cli to version 13.6.5 or later; its platform-specific dependency must also resolve to version 13.6.5 or later. Otherwise update the CLI through its installation method.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the [Aspire repository](https://github.com/microsoft/aspire).\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120792](https://www.cve.org/CVERecord?id=CVE-2026-120792)\n\n### Acknowledgements\n\n- l8BL with [ENKI WhiteHat](https://enki.co.kr/)\n- 71C4\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"},{"fixed":"13.6.5"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-musl-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-musl-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-q6jf-24jf-m3cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/518"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22100"},{"type":"WEB","url":"https://github.com/microsoft/aspire/pull/22071"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/c408ec5bf44e43203c278990a43aea93145248f3"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120792"}],"database_specific":{"cwe_ids":["CWE-532"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:31:23Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-r8h3-p8p6-ggp7.json b/data/NuGet/GHSA-r8h3-p8p6-ggp7.json new file mode 100644 index 0000000000..cacdebf96d --- /dev/null +++ b/data/NuGet/GHSA-r8h3-p8p6-ggp7.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-r8h3-p8p6-ggp7","published":"2026-11-11T00:34:13Z","modified":"2026-11-11T00:45:08.690361526Z","aliases":["CVE-2026-114158"],"summary":"Microsoft Security Advisory CVE-2026-114158 - Visual Studio Remote Code Execution Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nA Portable PDB `EmbeddedSource` record with parent RID 0 can trigger an out-of-bounds write.\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-122\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** x86, x64, Arm64\n\n## Affected Packages\n\nMicrosoft.DiaSymReader.Native components bundled with the affected .NET versions listed below are affected when initializing the native reader with a crafted Portable PDB containing an `EmbeddedSource` record with parent RID 0. The Windows runtime's native stack-trace reader can reach this initialization through its native-reader fallback.\n\n### .NET on Windows\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34\n.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23\n.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15\n.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows runtime packages for self-contained applications\n\nThe following packages deliver the affected .NET native reader. Exposure requires the PDB-reading operation described above; the presence of the reader does not make every application or symbol-reading path vulnerable.\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows SDK updates\n\nThe following SDK updates include the corrected .NET runtime. Update each installed Windows SDK feature band:\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx on Windows | >= 8.0.100-0, < 8.0.134 | 8.0.134\n.NET SDK 8.0.4xx on Windows | >= 8.0.400-0, < 8.0.428 | 8.0.428\n.NET SDK 9.0.1xx on Windows | >= 9.0.100-0, < 9.0.124 | 9.0.124\n.NET SDK 9.0.3xx on Windows | >= 9.0.300-0, < 9.0.321 | 9.0.321\n.NET SDK 10.0.1xx on Windows | >= 10.0.100-0, < 10.0.115 | 10.0.115\n.NET SDK 10.0.4xx on Windows | >= 10.0.400-0, < 10.0.404 | 10.0.404\n.NET SDK 11.0.1xx on Windows | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nApplications using Microsoft.DiaSymReader.Native components bundled with the affected .NET versions listed above to initialize the native reader with a crafted Portable PDB containing an `EmbeddedSource` record with parent RID 0 are exposed on x86, x64, and Arm64. The Windows runtime's native stack-trace reader can reach this initialization when PE metadata selects its native-reader fallback. See [affected packages](#affected-packages) for the affected .NET products on Windows.\n\n### How do I fix the issue?\n\nUpdate affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.\n\nFor applications that deploy their own .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.\n\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/520\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114158](https://www.cve.org/CVERecord?id=CVE-2026-114158)\n\n### Acknowledgements\n\n- [h4urek](https://x.com/h4urek) with [secsys lab](https://secsys.fudan.edu.cn/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r8h3-p8p6-ggp7/GHSA-r8h3-p8p6-ggp7.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-r8h3-p8p6-ggp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114158"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/520"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137295"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"WEB","url":"https://github.com/dotnet/core/releases/tag/v11.0.0"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114158"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:34:13Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-x8x8-p968-x646.json b/data/NuGet/GHSA-x8x8-p968-x646.json new file mode 100644 index 0000000000..4ae7945821 --- /dev/null +++ b/data/NuGet/GHSA-x8x8-p968-x646.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-x8x8-p968-x646","published":"2026-11-11T00:47:20Z","modified":"2026-11-11T01:00:35.069542281Z","aliases":["CVE-2026-118745"],"summary":"Microsoft Security Advisory CVE-2026-118745 - Visual Studio Remote Code Execution Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nCrafted PDB line metadata can exceed the caller-provided buffer and cause a heap out-of-bounds write.\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-122\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** x86, x64, Arm64\n\n## Affected Packages\n\nOn Windows x86, x64, and Arm64, Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when reading crafted native PDBs.\n\n### .NET on Windows\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34\n.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23\n.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15\n.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows self-contained runtime packs\n\nThese runtime packs deliver the .NET runtime for Windows self-contained applications.\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows SDK distributions\n\nThese Windows SDK distributions are affected through their bundled .NET runtime.\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134\n.NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428\n.NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124\n.NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321\n.NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115\n.NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404\n.NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100\n\n### Windows SDK updates\n\nUpdate each installed SDK feature band to the following version or later:\n\n- .NET SDK 8.0.1xx: 8.0.134\n- .NET SDK 8.0.4xx: 8.0.428\n- .NET SDK 9.0.1xx: 9.0.124\n- .NET SDK 9.0.3xx: 9.0.321\n- .NET SDK 10.0.1xx: 10.0.115\n- .NET SDK 10.0.4xx: 10.0.404\n- .NET SDK 11.0.1xx: 11.0.100\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nApplications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 on Windows x86, x64, and Arm64 to read crafted native PDBs are exposed. See [affected packages](#affected-packages) for the affected .NET products on Windows.\n\n### How do I fix the issue?\n\nUpdate affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.\n\nMicrosoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n## Announcement\n\nhttps://github.com/dotnet/announcements/issues/524\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-118745](https://www.cve.org/CVERecord?id=CVE-2026-118745)\n\n### Acknowledgements\n\n- Quac Tran\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-x8x8-p968-x646/GHSA-x8x8-p968-x646.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-x8x8-p968-x646"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118745"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/498"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/524"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137280"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118745"}],"database_specific":{"cwe_ids":["CWE-122"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:47:20Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/NuGet/GHSA-xf35-v9jh-g65w.json b/data/NuGet/GHSA-xf35-v9jh-g65w.json new file mode 100644 index 0000000000..f077b8e482 --- /dev/null +++ b/data/NuGet/GHSA-xf35-v9jh-g65w.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-xf35-v9jh-g65w","published":"2026-11-11T00:46:12Z","modified":"2026-11-11T01:00:38.266862597Z","aliases":["CVE-2026-114152"],"summary":"Microsoft Security Advisory CVE-2026-114152 - Visual Studio Remote Code Execution Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.\n\nAttacker-controlled COFF relocation offsets can cause an out-of-bounds stack write in `DiaObjectFile::ApplyFixup`.\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 8.8 (base score)\n- **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C`\n- **Weakness:** CWE-121, CWE-822\n\n## Affected Platforms\n\n- **Platforms:** Windows\n- **Architectures:** x86, x64, Arm64\n\n## Affected Packages\n\nMicrosoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 are affected when loading document specifications from a PDB that references an attacker-influenced COFF object.\n\n### .NET on Windows\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET 8.0 installed on Windows | >= 8.0.0, < 8.0.34 | 8.0.34\n.NET 9.0 installed on Windows | >= 9.0.0, < 9.0.23 | 9.0.23\n.NET 10.0 installed on Windows | >= 10.0.0, < 10.0.15 | 10.0.15\n.NET 11.0 installed on Windows | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows self-contained runtime packs\n\nThese runtime packs deliver the .NET runtime for Windows self-contained applications.\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 8.0.0, < 8.0.34 | 8.0.34\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 9.0.0, < 9.0.23 | 9.0.23\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 10.0.0, < 10.0.15 | 10.0.15\n[Microsoft.NETCore.App.Runtime.win-x86](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x86) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-x64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-x64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n[Microsoft.NETCore.App.Runtime.win-arm64](https://www.nuget.org/packages/Microsoft.NETCore.App.Runtime.win-arm64) | >= 11.0.0-preview.1, < 11.0.0 | 11.0.0\n\n### Windows SDK distributions\n\nThese Windows SDK distributions are affected through their bundled .NET runtime.\n\nProduct | Affected version | Patched version\n--- | --- | ---\n.NET SDK 8.0.1xx | >= 8.0.100-0, < 8.0.134 | 8.0.134\n.NET SDK 8.0.4xx | >= 8.0.400-0, < 8.0.428 | 8.0.428\n.NET SDK 9.0.1xx | >= 9.0.100-0, < 9.0.124 | 9.0.124\n.NET SDK 9.0.3xx | >= 9.0.300-0, < 9.0.321 | 9.0.321\n.NET SDK 10.0.1xx | >= 10.0.100-0, < 10.0.115 | 10.0.115\n.NET SDK 10.0.4xx | >= 10.0.400-0, < 10.0.404 | 10.0.404\n.NET SDK 11.0.1xx | >= 11.0.100-preview.1, < 11.0.100 | 11.0.100\n\n### Windows SDK updates\n\nUpdate each installed SDK feature band to the following version or later:\n\n- .NET SDK 8.0.1xx: 8.0.134\n- .NET SDK 8.0.4xx: 8.0.428\n- .NET SDK 9.0.1xx: 9.0.124\n- .NET SDK 9.0.3xx: 9.0.321\n- .NET SDK 10.0.1xx: 10.0.115\n- .NET SDK 10.0.4xx: 10.0.404\n- .NET SDK 11.0.1xx: 11.0.100\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nApplications using Microsoft.DiaSymReader.Native versions earlier than 18.9.1-beta1.26515.1 to load document specifications from a PDB that references an attacker-influenced COFF object are exposed on x86, x64, and Arm64. The SDK distributions listed above are affected through their bundled .NET runtime. See [affected packages](#affected-packages) for the affected .NET products on Windows.\n\n### How do I fix the issue?\n\nUpdate affected .NET installations and each installed SDK feature band to the versions listed above or later. If an SDK was installed through Visual Studio, update Visual Studio as well.\n\nMicrosoft.DiaSymReader.Native is delivered through .NET Core rather than as a standalone customer NuGet update. For applications that deploy their own affected .NET runtime, including self-contained applications, update the runtime used to build the application, rebuild, and redeploy. Updating a machine-wide runtime does not replace an application's embedded runtime. Restart processes that have loaded the affected native reader.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n## Announcement\n\nhttps://github.com/dotnet/announcements/issues/523\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-114152](https://www.cve.org/CVERecord?id=CVE-2026-114152)\n\n### Acknowledgements\n\n- [C0rk1](https://x.com/c0rk1_h)\n- 41ae55e9310ff27fa6f26af4727e5590\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.0.34"}]}],"versions":["8.0.0","8.0.1","8.0.10","8.0.11","8.0.12","8.0.13","8.0.14","8.0.15","8.0.16","8.0.17","8.0.18","8.0.19","8.0.2","8.0.20","8.0.21","8.0.22","8.0.23","8.0.24","8.0.25","8.0.26","8.0.27","8.0.28","8.0.29","8.0.3","8.0.30","8.0.31","8.0.32","8.0.33","8.0.4","8.0.5","8.0.6","8.0.7","8.0.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.23"}]}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.15"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x86","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x86"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-x64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}},{"package":{"name":"Microsoft.NETCore.App.Runtime.win-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.NETCore.App.Runtime.win-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-preview.1"},{"fixed":"11.0.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-xf35-v9jh-g65w/GHSA-xf35-v9jh-g65w.json"}}],"references":[{"type":"WEB","url":"https://github.com/dotnet/runtime/security/advisories/GHSA-xf35-v9jh-g65w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114152"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/498"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/523"},{"type":"WEB","url":"https://github.com/dotnet/runtime/issues/137280"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.15/10.0.15.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.34/8.0.34.md"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.23/9.0.23.md"},{"type":"PACKAGE","url":"https://github.com/dotnet/runtime"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v10.0.15"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v11.0.0"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v8.0.34"},{"type":"WEB","url":"https://github.com/dotnet/runtime/releases/tag/v9.0.23"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114152"}],"database_specific":{"cwe_ids":["CWE-121","CWE-822"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:46:12Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}]} \ No newline at end of file diff --git a/data/PyPI/GHSA-6f4g-xm8v-pgv6.json b/data/PyPI/GHSA-6f4g-xm8v-pgv6.json index ec94adac77..92442607f2 100644 --- a/data/PyPI/GHSA-6f4g-xm8v-pgv6.json +++ b/data/PyPI/GHSA-6f4g-xm8v-pgv6.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"GHSA-6f4g-xm8v-pgv6","published":"2026-11-10T15:56:59Z","modified":"2026-11-10T16:15:05.047506371Z","aliases":["CVE-2026-123369"],"summary":"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action","details":"### Impact\n\nThe GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:\n\n- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`)\n- fold the rest of the log, including the real verdict, out of sight (`##[group]`)\n- blank out chosen strings for the rest of the log (`##[add-mask]`)\n\nGitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action's own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.\n\nThe exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.\n\nFound during an internal pre-1.0 security review.\n\n### Patches\n\nFixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint's output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.\n\n### Workarounds\n\n- In your own workflow, wrap the compose-lint step in `::stop-commands::` and `::::`.\n- Use `--format json` or `--format sarif` rather than the text report when linting untrusted pull requests.\n\n### Reproduction\n\n```yaml\nservices:\n web:\n image: \"nginx:1.25\"\n environment:\n \"##[error]DB_PASSWORD\": placeholder\n \"##[group]svc\":\n image: \"nginx:1.25\"\n privileged: true\n```\n\nRun through the Action, this produces a fake error annotation and folds the remaining log lines, including the FAIL verdict, into a collapsed group.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.31.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"60c091c7cc8f86c6b0c5954031097364fea0a201"},{"fixed":"a6a7a76736de1c72abfa96c41ff8af556ffdc55f"}]}],"versions":["v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.2","v0.15.1","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.7","v0.3.6","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}},{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123369"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/918"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:56:59Z","nvd_published_at":"2026-11-09T18:17:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-6f4g-xm8v-pgv6","published":"2026-11-10T15:56:59Z","modified":"2026-11-11T02:57:10.295103665Z","aliases":["CVE-2026-123369"],"related":["CVE-2026-125121"],"summary":"compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action","details":"### Impact\n\nThe GitHub Actions runner treats certain text in a step's output as commands. The legacy form, `##[command]`, is recognized anywhere in a line. compose-lint's text report prints service names, environment keys and lines of the Compose file, and it does not neutralize `##[`. Inside the compose-lint Action, a Compose file from a pull request can therefore:\n\n- create fake error or warning annotations on the pull request (`##[error]`, `##[warning]`)\n- fold the rest of the log, including the real verdict, out of sight (`##[group]`)\n- blank out chosen strings for the rest of the log (`##[add-mask]`)\n\nGitHub has postponed removing the deprecated `set-output` log command, so the runner still honors it. A test run of the Action on a GitHub-hosted runner confirmed that a `::set-output` line from a Compose file is processed. Whether it can override the Action's own `sarif-written` output, which decides whether the SARIF upload step runs, has not been tested.\n\nThe exit code and the pass/fail result are not affected. Azure Pipelines parses the same `##[` syntax, so the pip package is listed for anyone printing the text report in other CI systems.\n\nFound during an internal pre-1.0 security review.\n\n### Patches\n\nFixed in 0.31.0. The Action stops the runner from processing workflow commands while compose-lint's output is printed, using a random `stop-commands` token. The text report also escapes `##[`, and `::` at the start of a line, in anything taken from the Compose file.\n\n### Workarounds\n\n- In your own workflow, wrap the compose-lint step in `::stop-commands::` and `::::`.\n- Use `--format json` or `--format sarif` rather than the text report when linting untrusted pull requests.\n\n### Reproduction\n\n```yaml\nservices:\n web:\n image: \"nginx:1.25\"\n environment:\n \"##[error]DB_PASSWORD\": placeholder\n \"##[group]svc\":\n image: \"nginx:1.25\"\n privileged: true\n```\n\nRun through the Action, this produces a fake error annotation and folds the remaining log lines, including the FAIL verdict, into a collapsed group.","affected":[{"package":{"name":"tmatens/compose-lint","ecosystem":"GitHub Actions"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.0"},{"fixed":"0.31.0"}]},{"type":"GIT","repo":"https://github.com/tmatens/compose-lint","events":[{"introduced":"60c091c7cc8f86c6b0c5954031097364fea0a201"},{"fixed":"a6a7a76736de1c72abfa96c41ff8af556ffdc55f"}]}],"versions":["v0.30.0","v0.29.0","v0.28.0","v0.27.0","v0.26.0","v0.25.0","v0.24.0","v0.23.0","v0.22.0","v0.21.0","v0.20.0","v0.19.0","v0.18.0","v0.17.0","v0.16.0","v0.15.2","v0.15.1","v0.15.0","v0.14.1","v0.14.0","v0.13.0","v0.12.2","v0.12.1","v0.12.0","v0.11.0","v0.10.0","v0.9.0","v0.8.0","v0.7.1","v0.7.0","v0.6.0","v0.5.2","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.7","v0.3.6","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}},{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.0"}]}],"versions":["0.10.0","0.11.0","0.12.0","0.12.1","0.12.2","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.17.0","0.18.0","0.19.0","0.2.0","0.20.0","0.21.0","0.22.0","0.23.0","0.24.0","0.25.0","0.26.0","0.27.0","0.28.0","0.29.0","0.3.0","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.30.0","0.4.0","0.4.1","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.7.1","0.8.0","0.9.0"],"database_specific":{"last_known_affected_version_range":"<= 0.30.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-6f4g-xm8v-pgv6/GHSA-6f4g-xm8v-pgv6.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-6f4g-xm8v-pgv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123369"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/918"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/672bd11145621f787c295fb11f3a859cdec1b38d"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.31.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:56:59Z","nvd_published_at":"2026-11-09T18:17:25Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]} \ No newline at end of file diff --git a/data/PyPI/GHSA-r7j4-crjv-h467.json b/data/PyPI/GHSA-r7j4-crjv-h467.json index 2877b5538d..50baaed229 100644 --- a/data/PyPI/GHSA-r7j4-crjv-h467.json +++ b/data/PyPI/GHSA-r7j4-crjv-h467.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"GHSA-r7j4-crjv-h467","published":"2026-11-10T18:28:35Z","modified":"2026-11-10T18:45:03.491003748Z","aliases":["CVE-2026-125121"],"summary":"compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report \"escapes both openers (also covering Azure Pipelines)\". Five paths were left open:\n\n- **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report's file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report's fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics.\n- **JSON and SARIF printed to stdout.** `--format json` and `--format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn't redirected to a file.\n- **Command-line errors.** When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n- **Azure Pipelines.** `##vso[` logging commands were not escaped on any path, despite the changelog's Azure claim.\n- **An error message in the GitHub Action (0.30.0 and 0.31.0).** When `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message, outside the window in which it turns command processing off. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups are those that print compose-lint's output to a CI log without the GitHub Action: the `compose-lint` package run directly in a workflow, the pre-commit hook run in CI, and the Docker image. The pre-commit hook is affected in its default configuration: it passes each changed file's path to compose-lint, and a path whose directory name starts with Unicode whitespace and `::` reaches the report's file heading. The JSON/SARIF and command-line paths also need output left on stdout, or `args:` without the documented trailing `--`, which is why they alone would score lower. The GitHub Action turns command processing off around each compose-lint run, so of these paths only its own error message affects it, and only when `sarif-file:` points into a subdirectory. That setup is outside the documented one, which is why that path alone would also score lower.\n\nFound during an internal pre-1.0 security review.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0, the matching minor tag, and `latest` are affected.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6, except the Action's error message, which also affects Action 0.30.0.\n\n### Patches\n\nFixed in 0.32.0. The line-start escaping covers every character the runner strips before `::`, so it holds for quoted values and file names alike. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data. argparse's own messages go through the same sanitizer. `##vso[` is escaped everywhere. In the Action, the SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::` and `::::`, as the Action does.\n- In the Action, keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- End the pre-commit hook's `args:` with `--`. This closes the command-line path only; it does not stop a file name at the start of a report line, so in CI also bracket the pre-commit step with `::stop-commands::` as above.\n- On Azure Pipelines, don't print compose-lint's output from runs over untrusted pull requests to the job log.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), each of the following creates an annotation:\n\n- a Compose file with `image: \"nginx\\n\\u00a0::notice::X\"`, linted with the text report;\n- a directory named `\\u00a0::notice::X` (a no-break space, then `::notice::X`) holding a `compose.yml`, linted with `compose-lint -- '/compose.yml'`, or by the pre-commit hook in its default configuration;\n- a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout;\n- `compose-lint '--##[warning]X/compose.yml'` with no `--`;\n- the Action with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`.\n\nThe same inputs with a plain space in place of the no-break space, or with `--` before the path, or with `sarif-file` at the repository root, create none. The same inputs on compose-lint 0.30.0 create annotations even with a plain space, which is GHSA-6f4g-xm8v-pgv6. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T18:28:35Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"GHSA-r7j4-crjv-h467","published":"2026-11-10T18:28:35Z","modified":"2026-11-11T02:57:10.229433909Z","aliases":["CVE-2026-125121"],"related":["CVE-2026-125121"],"summary":"compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output","details":"### Impact\n\n0.31.0 fixed GHSA-6f4g-xm8v-pgv6, where text from a Compose file became GitHub Actions workflow commands in compose-lint's output. The fix escapes the command openers in everything compose-lint prints, and the 0.31.0 changelog says the report \"escapes both openers (also covering Azure Pipelines)\". Five paths were left open:\n\n- **Unicode whitespace before a line-leading `::`.** The runner strips all Unicode whitespace from the start of a line before it looks for a command. compose-lint only accounted for spaces and tabs, so a no-break space or another Unicode space ahead of `::` is not escaped. It can come from a Compose value, or from a file name: the text report's file heading and per-file summary, and the `fix` summary on stderr, start with the path as given, so a directory named with a leading no-break space followed by `::` puts a command at the start of a line. This reaches those lines, the text report's fix guidance, the `fix` dry-run diff, and continuation lines of stderr diagnostics.\n- **JSON and SARIF printed to stdout.** `--format json` and `--format sarif` output never passed through the sanitizer, so `##[` inside a service name or other value reaches the log intact when the output isn't redirected to a file.\n- **Command-line errors.** When a repository path reaches compose-lint's arguments without a `--` before it, the argument parser prints it raw in its error message. That includes a carriage return, which the runner treats as a line break, so a command can also start a new line there.\n- **Azure Pipelines.** `##vso[` logging commands were not escaped on any path, despite the changelog's Azure claim.\n- **An error message in the GitHub Action (0.30.0 and 0.31.0).** When `sarif-file:` names a file in a subdirectory that can't be created, the Action prints the directory's resolved path in an error message, outside the window in which it turns command processing off. A pull request can commit a symlink on that path to a directory whose name contains a newline followed by a command. The documented setup, `sarif-file: results.sarif` at the repository root, is not affected.\n\nA pull request can therefore create annotations, fold or hide parts of the job log, or issue other commands the runner accepts, when CI runs compose-lint over it, before anyone reviews it. The pass/fail result is not changed.\n\nAffected setups are those that print compose-lint's output to a CI log without the GitHub Action: the `compose-lint` package run directly in a workflow, the pre-commit hook run in CI, and the Docker image. The pre-commit hook is affected in its default configuration: it passes each changed file's path to compose-lint, and a path whose directory name starts with Unicode whitespace and `::` reaches the report's file heading. The JSON/SARIF and command-line paths also need output left on stdout, or `args:` without the documented trailing `--`, which is why they alone would score lower. The GitHub Action turns command processing off around each compose-lint run, so of these paths only its own error message affects it, and only when `sarif-file:` points into a subdirectory. That setup is outside the documented one, which is why that path alone would also score lower.\n\nFound during an internal pre-1.0 security review.\n\n**Docker image.** `composelint/compose-lint` tag 0.31.0, the matching minor tag, and `latest` are affected.\n\nReleases before 0.31.0 are covered by GHSA-6f4g-xm8v-pgv6, except the Action's error message, which also affects Action 0.30.0.\n\n### Patches\n\nFixed in 0.32.0. The line-start escaping covers every character the runner strips before `::`, so it holds for quoted values and file names alike. JSON and SARIF on stdout escape `##[` inside strings as `\\u005b`, which decodes to the same data. argparse's own messages go through the same sanitizer. `##vso[` is escaped everywhere. In the Action, the SARIF-directory error names the `sarif-file:` input as written.\n\n### Workarounds\n\n- Upgrade to 0.32.0 or later.\n- On GitHub Actions, use the `tmatens/compose-lint` Action, or bracket the compose-lint step with `::stop-commands::` and `::::`, as the Action does.\n- In the Action, keep `sarif-file` at the workspace root, for example `sarif-file: results.sarif`.\n- Write `--format json` and `--format sarif` output to a file rather than the log.\n- End the pre-commit hook's `args:` with `--`. This closes the command-line path only; it does not stop a file name at the start of a report line, so in CI also bracket the pre-commit step with `::stop-commands::` as above.\n- On Azure Pipelines, don't print compose-lint's output from runs over untrusted pull requests to the job log.\n\n### Reproduction\n\nOn compose-lint 0.31.0 on a GitHub-hosted runner (runner 2.337.0), each of the following creates an annotation:\n\n- a Compose file with `image: \"nginx\\n\\u00a0::notice::X\"`, linted with the text report;\n- a directory named `\\u00a0::notice::X` (a no-break space, then `::notice::X`) holding a `compose.yml`, linted with `compose-lint -- '/compose.yml'`, or by the pre-commit hook in its default configuration;\n- a service named `a##[warning]X`, linted with `--format json` or `--format sarif` to stdout;\n- `compose-lint '--##[warning]X/compose.yml'` with no `--`;\n- the Action with `sarif-file: out/reports/results.sarif`, where `out` is a committed symlink to a directory named `d\\n::warning::X` that contains a regular file `reports`.\n\nThe same inputs with a plain space in place of the no-break space, or with `--` before the path, or with `sarif-file` at the repository root, create none. The same inputs on compose-lint 0.30.0 create annotations even with a plain space, which is GHSA-6f4g-xm8v-pgv6. The `composelint/compose-lint:0.31.0` image produces byte-identical output to the package.","affected":[{"package":{"name":"compose-lint","ecosystem":"PyPI","purl":"pkg:pypi/compose-lint"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.31.0"},{"fixed":"0.32.0"}]}],"versions":["0.31.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-r7j4-crjv-h467/GHSA-r7j4-crjv-h467.json"}}],"references":[{"type":"WEB","url":"https://github.com/tmatens/compose-lint/security/advisories/GHSA-r7j4-crjv-h467"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/pull/945"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/commit/542e63126f795564a65c63887ea0dc558a500688"},{"type":"PACKAGE","url":"https://github.com/tmatens/compose-lint"},{"type":"WEB","url":"https://github.com/tmatens/compose-lint/releases/tag/v0.32.0"}],"database_specific":{"cwe_ids":["CWE-117","CWE-150"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T18:28:35Z","nvd_published_at":null,"severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}]} \ No newline at end of file diff --git a/data/npm/GHSA-m63f-xhvm-6mv5.json b/data/npm/GHSA-m63f-xhvm-6mv5.json new file mode 100644 index 0000000000..8be282f27a --- /dev/null +++ b/data/npm/GHSA-m63f-xhvm-6mv5.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-m63f-xhvm-6mv5","published":"2026-11-11T00:30:06Z","modified":"2026-11-11T00:45:04.314908859Z","aliases":["CVE-2026-120778"],"summary":"Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.\n\nAn insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/519\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.3\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H`\n- **Weakness:** CWE-379 (Creation of Temporary File in Directory with Insecure Permissions)\n- **MSRC severity:** Important\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** x64, Arm64\n\n## Affected Packages\n\n### Standalone Aspire CLI\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[Aspire.Cli](https://www.nuget.org/packages/Aspire.Cli) | >= 13.2.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-x64](https://www.nuget.org/packages/Aspire.Cli.linux-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-arm64](https://www.nuget.org/packages/Aspire.Cli.linux-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-musl-x64](https://www.nuget.org/packages/Aspire.Cli.linux-musl-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-x64](https://www.nuget.org/packages/Aspire.Cli.osx-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-arm64](https://www.nuget.org/packages/Aspire.Cli.osx-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n\n### Aspire CLI npm packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[@microsoft/aspire-cli](https://www.npmjs.com/package/@microsoft/aspire-cli) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-musl-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-musl-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n\nThe affected scenario concerns CLI-generated server and integration builds on non-Windows systems when a local attacker can influence automatic MSBuild response-file discovery through an attacker-writable directory. This includes builds started by `aspire sdk generate`, `aspire sdk dump`, and `aspire sdk export`.\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nThe reported scenario involves a local attacker influencing a generated build through a shared temporary-directory ancestor while another user invokes the Aspire CLI. Versions 13.2.0 through 13.6.4 are affected.\n\nAspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire CLI has been updated.\n\n### How do I fix the issue?\n\nUpdate the Aspire CLI to version 13.6.5 or later. If installed as a .NET tool, update the Aspire.Cli package. If installed using npm, update @microsoft/aspire-cli to version 13.6.5 or later; its platform-specific dependency must also resolve to version 13.6.5 or later. Otherwise update the CLI through its installation method.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the [Aspire repository](https://github.com/microsoft/aspire).\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120778](https://www.cve.org/CVERecord?id=CVE-2026-120778)\n\n### Acknowledgements\n\n- l8BL with [ENKI WhiteHat](https://enki.co.kr/)\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"},{"fixed":"13.6.5"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"Aspire.Cli.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-musl-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-musl-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-m63f-xhvm-6mv5/GHSA-m63f-xhvm-6mv5.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-m63f-xhvm-6mv5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/519"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22101"},{"type":"WEB","url":"https://github.com/microsoft/aspire/pull/22071"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/1ecd7cc70b5a5a5b8571fe3af69faa1646b8de47"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"database_specific":{"cwe_ids":["CWE-379"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:30:06Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]} \ No newline at end of file diff --git a/data/npm/GHSA-q6jf-24jf-m3cg.json b/data/npm/GHSA-q6jf-24jf-m3cg.json new file mode 100644 index 0000000000..5ee480d06e --- /dev/null +++ b/data/npm/GHSA-q6jf-24jf-m3cg.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"GHSA-q6jf-24jf-m3cg","published":"2026-11-11T00:31:23Z","modified":"2026-11-11T00:45:04.289567958Z","aliases":["CVE-2026-120792"],"summary":"Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","details":"## Executive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.\n\nInsecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/518\n\n## CVSS Details\n\n- **Version:** 3.1\n- **Severity:** High\n- **Score:** 7.3\n- **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L`\n- **Weakness:** CWE-532 (Insertion of Sensitive Information into Log File)\n- **MSRC severity:** Important\n- **Impact:** Information Disclosure\n\n## Affected Platforms\n\n- **Platforms:** Linux, macOS\n- **Architectures:** x64, Arm64\n\n## Affected Packages\n\n### Standalone Aspire CLI\n\nPackage | Affected version | Patched version\n--- | --- | ---\nAspire CLI ([Aspire.Cli](https://www.nuget.org/packages/Aspire.Cli)) | >= 13.2.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-x64](https://www.nuget.org/packages/Aspire.Cli.linux-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-arm64](https://www.nuget.org/packages/Aspire.Cli.linux-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.linux-musl-x64](https://www.nuget.org/packages/Aspire.Cli.linux-musl-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-x64](https://www.nuget.org/packages/Aspire.Cli.osx-x64) | >= 13.3.0, < 13.6.5 | 13.6.5\n[Aspire.Cli.osx-arm64](https://www.nuget.org/packages/Aspire.Cli.osx-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5\n\n### Aspire CLI npm packages\n\nPackage | Affected version | Patched version\n--- | --- | ---\n[@microsoft/aspire-cli](https://www.npmjs.com/package/@microsoft/aspire-cli) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-linux-musl-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-linux-musl-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-x64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-x64) | >= 13.4.2, < 13.6.5 | 13.6.5\n[@microsoft/aspire-cli-osx-arm64](https://www.npmjs.com/package/@microsoft/aspire-cli-osx-arm64) | >= 13.4.2, < 13.6.5 | 13.6.5\n\nThe affected component is the Aspire CLI's deprecated MCP configuration scanner, which ships in the CLI packages listed above. Its temporary-file diagnostics can include configuration content and use a fixed path in a shared temporary directory.\n\n## Advisory FAQ\n\n### How do I know if I am affected?\n\nThe reported scenario involves running Aspire CLI agent or MCP initialization commands on a non-Windows system with a temporary directory shared by multiple users. Versions 13.2.0 through 13.6.4 are affected.\n\nAspire ships independently of .NET. Installing a .NET runtime or SDK update does not establish that the affected Aspire CLI has been updated.\n\n### How do I fix the issue?\n\nUpdate the Aspire CLI to version 13.6.5 or later. If installed as a .NET tool, update the Aspire.Cli package. If installed using npm, update @microsoft/aspire-cli to version 13.6.5 or later; its platform-specific dependency must also resolve to version 13.6.5 or later. Otherwise update the CLI through its installation method.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).\n\nSecurity reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.\n\n### Support\n\nYou can ask questions about this issue in the [Aspire repository](https://github.com/microsoft/aspire).\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.\n\n### External Links\n\n[CVE-2026-120792](https://www.cve.org/CVERecord?id=CVE-2026-120792)\n\n### Acknowledgements\n\n- l8BL with [ENKI WhiteHat](https://enki.co.kr/)\n- 71C4\n\n### Revisions\n\nV1.0 (November 10, 2026): Advisory published.","affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"},{"fixed":"13.6.5"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.linux-musl-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.linux-musl-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.osx-x64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-x64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"Aspire.Cli.osx-arm64","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli.osx-arm64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.3.0"},{"fixed":"13.6.5"}]}],"versions":["13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-linux-musl-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-linux-musl-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-x64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-x64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}},{"package":{"name":"@microsoft/aspire-cli-osx-arm64","ecosystem":"npm","purl":"pkg:npm/%40microsoft/aspire-cli-osx-arm64"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.4.2"},{"fixed":"13.6.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q6jf-24jf-m3cg/GHSA-q6jf-24jf-m3cg.json"}}],"references":[{"type":"WEB","url":"https://github.com/microsoft/aspire/security/advisories/GHSA-q6jf-24jf-m3cg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120792"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/518"},{"type":"WEB","url":"https://github.com/microsoft/aspire/issues/22100"},{"type":"WEB","url":"https://github.com/microsoft/aspire/pull/22071"},{"type":"WEB","url":"https://github.com/microsoft/aspire/commit/c408ec5bf44e43203c278990a43aea93145248f3"},{"type":"PACKAGE","url":"https://github.com/microsoft/aspire"},{"type":"WEB","url":"https://github.com/microsoft/aspire/releases/tag/v13.6.5"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120792"}],"database_specific":{"cwe_ids":["CWE-532"],"github_reviewed":true,"github_reviewed_at":"2026-11-11T00:31:23Z","nvd_published_at":null,"severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L"}]} \ No newline at end of file diff --git a/data/npm/GHSA-v3m3-f69x-jf25.json b/data/npm/GHSA-v3m3-f69x-jf25.json index 0303094df5..9b6e8eeac8 100644 --- a/data/npm/GHSA-v3m3-f69x-jf25.json +++ b/data/npm/GHSA-v3m3-f69x-jf25.json @@ -1 +1 @@ -{"schema_version":"1.9.0","id":"GHSA-v3m3-f69x-jf25","published":"2026-01-13T21:31:46Z","modified":"2026-04-10T19:50:16.959742Z","aliases":["CVE-2025-15056"],"summary":"Quill is vulnerable to XSS via HTML export feature","details":"A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.","affected":[{"package":{"name":"quill","ecosystem":"npm","purl":"pkg:npm/quill"},"versions":["2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-v3m3-f69x-jf25/GHSA-v3m3-f69x-jf25.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15056"},{"type":"WEB","url":"https://fluidattacks.com/advisories/diomedes"},{"type":"PACKAGE","url":"https://github.com/slab/quill"}],"database_specific":{"cwe_ids":["CWE-74","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T16:58:02Z","nvd_published_at":"2026-01-13T21:15:49Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P"}]} \ No newline at end of file +{"schema_version":"1.9.0","id":"GHSA-v3m3-f69x-jf25","published":"2026-01-13T21:31:46Z","modified":"2026-11-11T02:56:08.527587723Z","aliases":["CVE-2025-15056","CVE-2026-120350"],"summary":"Quill is vulnerable to XSS via HTML export feature","details":"A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS).\n\nThis issue affects Quill: 2.0.3.","affected":[{"package":{"name":"quill","ecosystem":"npm","purl":"pkg:npm/quill"},"versions":["2.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-v3m3-f69x-jf25/GHSA-v3m3-f69x-jf25.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15056"},{"type":"WEB","url":"https://fluidattacks.com/advisories/diomedes"},{"type":"PACKAGE","url":"https://github.com/slab/quill"}],"database_specific":{"cwe_ids":["CWE-74","CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-01-16T16:58:02Z","nvd_published_at":"2026-01-13T21:15:49Z","severity":"LOW"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P"}]} \ No newline at end of file diff --git a/data/npm/MAL-2026-18830.json b/data/npm/MAL-2026-18830.json index 83fbf1bff3..3abcd65ade 100644 --- a/data/npm/MAL-2026-18830.json +++ b/data/npm/MAL-2026-18830.json @@ -1 +1 @@ -{"schema_version":"1.9.2","id":"MAL-2026-18830","published":"2026-10-27T00:00:00Z","modified":"2026-11-09T23:15:21.343630205Z","summary":"Malicious code in @fadelsm/baileys (npm)","details":"@fadelsm/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400362472743@newsletter, 120363406524087186@newsletter, 120363407144637058@newsletter, 120363408367338249@newsletter, 120363409508273158@newsletter, 12036340982021544@newsletter and 4 more (stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).","affected":[{"package":{"name":"@fadelsm/baileys","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/baileys"},"versions":["7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/baileys/MAL-2026-18830.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@fadelsm/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"6124f083369ee555d0d0b32a9702f3f4c0008e4cac4a03195081e861e61297d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"71dfb4222ed6acd3f788c1e7fd58548e1a631d3b41256ba37b9b19c10d7b65d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"8ce0541a2fa8de1851064d401c13d8d7546e3bc347746ca969199a5aac48b850"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"bdf0161f9e9e7f14d77a8049da5cad6876c64882899f55b59875d3c9088b1676"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cca01b5bd1ff6181b1db9209d77f3e7faf3b8a399a21631543e782d58ffbf35a"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cf6c5a6b325c4e5a68fe43dd9d83002e1f19e1b522090540ff84e0b35e4fddab"},"paths":["lib/Socket/newsletter.js"]}],"ips":[],"urls":[]}},"credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-18830","published":"2026-10-27T00:00:00Z","modified":"2026-11-11T02:30:05.223569772Z","aliases":["GHSA-wf3c-x3cj-jjqq"],"summary":"Malicious code in @fadelsm/baileys (npm)","details":"@fadelsm/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel ID(s) 120363400362472743@newsletter, 120363406524087186@newsletter, 120363407144637058@newsletter, 120363408367338249@newsletter, 120363409508273158@newsletter, 12036340982021544@newsletter and 4 more (stored as character-code arrays), using the victim's authenticated session and without telling them. Same behaviour as the PhantomSub family (MAL-2026-17342).\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (f80e051ed0ff14355e74f63440e3a822906ea192ae9a33d99c0db99517cc7278)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@fadelsm/baileys","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/baileys/MAL-2026-18830.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@fadelsm/baileys"},{"type":"WEB","url":"https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wf3c-x3cj-jjqq"}],"database_specific":{"iocs":{"domains":[],"files":[{"digests":{"sha256":"6124f083369ee555d0d0b32a9702f3f4c0008e4cac4a03195081e861e61297d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"71dfb4222ed6acd3f788c1e7fd58548e1a631d3b41256ba37b9b19c10d7b65d4"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"8ce0541a2fa8de1851064d401c13d8d7546e3bc347746ca969199a5aac48b850"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"bdf0161f9e9e7f14d77a8049da5cad6876c64882899f55b59875d3c9088b1676"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cca01b5bd1ff6181b1db9209d77f3e7faf3b8a399a21631543e782d58ffbf35a"},"paths":["lib/Socket/newsletter.js"]},{"digests":{"sha256":"cf6c5a6b325c4e5a68fe43dd9d83002e1f19e1b522090540ff84e0b35e4fddab"},"paths":["lib/Socket/newsletter.js"]}],"ips":[],"urls":[]},"malicious-packages-origins":[{"id":"GHSA-wf3c-x3cj-jjqq","import_time":"2026-11-11T02:21:06.369579088Z","modified_time":"2026-11-11T01:29:44Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"f80e051ed0ff14355e74f63440e3a822906ea192ae9a33d99c0db99517cc7278","source":"ghsa-malware"}]},"credits":[{"name":"CyberXYZ","contact":["https://cyberxyz.io"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/npm/MAL-2026-19104.json b/data/npm/MAL-2026-19104.json new file mode 100644 index 0000000000..206f2fef38 --- /dev/null +++ b/data/npm/MAL-2026-19104.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19104","published":"2026-11-11T00:56:31Z","modified":"2026-11-11T01:30:04.202933342Z","aliases":["GHSA-w3r9-3pw6-qg6q"],"summary":"Malicious code in rex-react-diag-tools-v1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"rex-react-diag-tools-v1","ecosystem":"npm","purl":"pkg:npm/rex-react-diag-tools-v1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/rex-react-diag-tools-v1/MAL-2026-19104.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w3r9-3pw6-qg6q"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-w3r9-3pw6-qg6q","import_time":"2026-11-11T01:16:44.067768437Z","modified_time":"2026-11-11T00:56:32Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"aed5165f50b2beb552e0472d6c4edaad82d46104ffe7f1c2e5ffebd9f0e89399","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19105.json b/data/npm/MAL-2026-19105.json new file mode 100644 index 0000000000..9e4ee2840b --- /dev/null +++ b/data/npm/MAL-2026-19105.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19105","published":"2026-11-11T01:29:42Z","modified":"2026-11-11T02:30:05.177738400Z","aliases":["GHSA-7gq6-hj7j-wgh8"],"summary":"Malicious code in @fadelsm/libsignal-node (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (aff0386ff1ec2f5430a6ecadff8bcb770bb30ee67dfea1bfb8e22d702f9227a7)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@fadelsm/libsignal-node","ecosystem":"npm","purl":"pkg:npm/%40fadelsm/libsignal-node"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@fadelsm/libsignal-node/MAL-2026-19105.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gq6-hj7j-wgh8"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7gq6-hj7j-wgh8","import_time":"2026-11-11T02:21:06.328312284Z","modified_time":"2026-11-11T01:29:42Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"aff0386ff1ec2f5430a6ecadff8bcb770bb30ee67dfea1bfb8e22d702f9227a7","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19106.json b/data/npm/MAL-2026-19106.json new file mode 100644 index 0000000000..ec63eac244 --- /dev/null +++ b/data/npm/MAL-2026-19106.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19106","published":"2026-11-11T01:20:39Z","modified":"2026-11-11T02:30:05.194303187Z","aliases":["GHSA-hf56-v7wj-mjc9"],"summary":"Malicious code in pt-logger-telemetry-eax0x1 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (858ddb3c9812cdc7939d412116506a7a4613611f13958f1a1fefdf91bfc299f8)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"pt-logger-telemetry-eax0x1","ecosystem":"npm","purl":"pkg:npm/pt-logger-telemetry-eax0x1"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/pt-logger-telemetry-eax0x1/MAL-2026-19106.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hf56-v7wj-mjc9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-hf56-v7wj-mjc9","import_time":"2026-11-11T02:21:06.361267707Z","modified_time":"2026-11-11T01:20:41Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"858ddb3c9812cdc7939d412116506a7a4613611f13958f1a1fefdf91bfc299f8","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19107.json b/data/npm/MAL-2026-19107.json new file mode 100644 index 0000000000..939e856f49 --- /dev/null +++ b/data/npm/MAL-2026-19107.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19107","published":"2026-11-11T01:41:29Z","modified":"2026-11-11T02:30:05.187514495Z","aliases":["GHSA-v9xg-mgjf-74xm"],"summary":"Malicious code in yummy-bolts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (0033b56430d000f0165fce7fa13288fe5c4eec20456e47076f76d52c2d456a53)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"yummy-bolts","ecosystem":"npm","purl":"pkg:npm/yummy-bolts"},"versions":["1.4.0","1.3.1","1.3.0","1.2.0","1.1.0","1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/yummy-bolts/MAL-2026-19107.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v9xg-mgjf-74xm"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-v9xg-mgjf-74xm","import_time":"2026-11-11T02:21:06.367803444Z","modified_time":"2026-11-11T01:41:30Z","sha256":"0033b56430d000f0165fce7fa13288fe5c4eec20456e47076f76d52c2d456a53","source":"ghsa-malware","versions":["1.4.0","1.3.1","1.3.0","1.2.0","1.1.0","1.0.0"]}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19108.json b/data/npm/MAL-2026-19108.json new file mode 100644 index 0000000000..774ef75b21 --- /dev/null +++ b/data/npm/MAL-2026-19108.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19108","published":"2026-11-03T14:17:26Z","modified":"2026-11-11T04:15:05.495656773Z","summary":"Malicious code in raiden-baileys (npm)","details":"Malicious package. `raiden-baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). on connection it issues an authenticated `w:mex` newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363407277177688@newsletter, 120363407702752541@newsletter, 120363411769951302@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"raiden-baileys","ecosystem":"npm","purl":"pkg:npm/raiden-baileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/raiden-baileys/MAL-2026-19108.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/raiden-baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/npm/MAL-2026-19109.json b/data/npm/MAL-2026-19109.json new file mode 100644 index 0000000000..e2b678d4ca --- /dev/null +++ b/data/npm/MAL-2026-19109.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19109","published":"2026-11-03T14:18:12Z","modified":"2026-11-11T04:30:05.421619460Z","summary":"Malicious code in @lekzsync/baileys (npm)","details":"Malicious package. `@lekzsync/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363399602691477@newsletter, 120363421563597486@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"@lekzsync/baileys","ecosystem":"npm","purl":"pkg:npm/%40lekzsync%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","1.0.5"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@lekzsync/baileys/MAL-2026-19109.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@lekzsync/baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/npm/MAL-2026-19110.json b/data/npm/MAL-2026-19110.json new file mode 100644 index 0000000000..f9db6cac56 --- /dev/null +++ b/data/npm/MAL-2026-19110.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19110","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.427668488Z","aliases":["GHSA-rq54-jmqc-j8qj"],"summary":"Malicious code in @solana-trade/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (f9176979cfaf900e7e7daa2c479895c66659c6239842ae8c33a8fac2a76a090f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"@solana-trade/core","ecosystem":"npm","purl":"pkg:npm/%40solana-trade/core"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@solana-trade/core/MAL-2026-19110.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rq54-jmqc-j8qj"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-rq54-jmqc-j8qj","import_time":"2026-11-11T04:19:18.173540254Z","modified_time":"2026-11-11T04:07:11Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"f9176979cfaf900e7e7daa2c479895c66659c6239842ae8c33a8fac2a76a090f","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19111.json b/data/npm/MAL-2026-19111.json new file mode 100644 index 0000000000..2135c4e0d1 --- /dev/null +++ b/data/npm/MAL-2026-19111.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19111","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.422765083Z","aliases":["GHSA-cm5x-2764-c8p9"],"summary":"Malicious code in chalks-log (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (0989c6b31e99988848556608782ed4e28d21b14b9360324463765752195636d2)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"chalks-log","ecosystem":"npm","purl":"pkg:npm/chalks-log"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/chalks-log/MAL-2026-19111.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cm5x-2764-c8p9"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-cm5x-2764-c8p9","import_time":"2026-11-11T04:19:18.166115677Z","modified_time":"2026-11-11T04:07:11Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"0989c6b31e99988848556608782ed4e28d21b14b9360324463765752195636d2","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19112.json b/data/npm/MAL-2026-19112.json new file mode 100644 index 0000000000..1b2d25ae52 --- /dev/null +++ b/data/npm/MAL-2026-19112.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19112","published":"2026-11-11T03:52:30Z","modified":"2026-11-11T04:30:05.419737112Z","aliases":["GHSA-8cvx-wq76-pcwg"],"summary":"Malicious code in kbmathlessons (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (d751bbc7fdf5dfe21c87f18a21fbc1a35c748605158ac6e36b2188989c1e1046)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"kbmathlessons","ecosystem":"npm","purl":"pkg:npm/kbmathlessons"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/kbmathlessons/MAL-2026-19112.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8cvx-wq76-pcwg"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-8cvx-wq76-pcwg","import_time":"2026-11-11T04:19:18.165120837Z","modified_time":"2026-11-11T03:52:31Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"d751bbc7fdf5dfe21c87f18a21fbc1a35c748605158ac6e36b2188989c1e1046","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19113.json b/data/npm/MAL-2026-19113.json new file mode 100644 index 0000000000..28293242ac --- /dev/null +++ b/data/npm/MAL-2026-19113.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19113","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.426707884Z","aliases":["GHSA-7m86-chx9-8rr7"],"summary":"Malicious code in prettlog (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (c9360f4fd522539accffc042d86ef137413d37ca411e10caf0546e5523c4649f)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"prettlog","ecosystem":"npm","purl":"pkg:npm/prettlog"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/prettlog/MAL-2026-19113.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7m86-chx9-8rr7"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-7m86-chx9-8rr7","import_time":"2026-11-11T04:19:18.164355052Z","modified_time":"2026-11-11T04:07:10Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"c9360f4fd522539accffc042d86ef137413d37ca411e10caf0546e5523c4649f","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19114.json b/data/npm/MAL-2026-19114.json new file mode 100644 index 0000000000..03eb06579c --- /dev/null +++ b/data/npm/MAL-2026-19114.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19114","published":"2026-11-11T04:07:10Z","modified":"2026-11-11T04:30:05.419664594Z","aliases":["GHSA-727x-2mvh-8r5c"],"summary":"Malicious code in termchalk (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: ghsa-malware (b41f585c4e82520cf84ca20367823520bced473a6fbc03f50ab77c7c5bb83e77)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"termchalk","ecosystem":"npm","purl":"pkg:npm/termchalk"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/termchalk/MAL-2026-19114.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-727x-2mvh-8r5c"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-727x-2mvh-8r5c","import_time":"2026-11-11T04:19:18.101987731Z","modified_time":"2026-11-11T04:07:10Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"b41f585c4e82520cf84ca20367823520bced473a6fbc03f50ab77c7c5bb83e77","source":"ghsa-malware"}]}} \ No newline at end of file diff --git a/data/npm/MAL-2026-19115.json b/data/npm/MAL-2026-19115.json new file mode 100644 index 0000000000..5c8ff83cc7 --- /dev/null +++ b/data/npm/MAL-2026-19115.json @@ -0,0 +1 @@ +{"schema_version":"1.9.2","id":"MAL-2026-19115","published":"2026-11-03T14:18:58Z","modified":"2026-11-11T04:30:05.424272107Z","summary":"Malicious code in @zhengliyoux/baileys (npm)","details":"Malicious package. `@zhengliyoux/baileys` is a trojanized fork of the Baileys WhatsApp library (@whiskeysockets/baileys). it silently subscribes every victim (via the injected WhatsApp newsletter/channel FOLLOW on connect) to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs: 120363430894218102@newsletter. Legitimate Baileys never hardcodes a channel JID or auto-follows on connect; all published versions are malicious.","affected":[{"package":{"name":"@zhengliyoux/baileys","ecosystem":"npm","purl":"pkg:npm/%40zhengliyoux%2Fbaileys"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["0.0.0-stage","1.0.2","1.0.3","1.0.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@zhengliyoux/baileys/MAL-2026-19115.json"}}],"references":[{"type":"WEB","url":"https://wormsign.io/portfolio/@zhengliyoux/baileys/"}],"database_specific":{"iocs":{}},"credits":[{"name":"wormsign","contact":["https://x.com/w0rmsign"],"type":"FINDER"}]} \ No newline at end of file diff --git a/data/npm/MAL-2026-2907.json b/data/npm/MAL-2026-2907.json index 07795d4d2c..bb142118e9 100644 --- a/data/npm/MAL-2026-2907.json +++ b/data/npm/MAL-2026-2907.json @@ -1 +1 @@ -{"schema_version":"1.7.5","id":"MAL-2026-2907","published":"2026-04-16T02:50:55Z","modified":"2026-04-23T21:21:34.761597Z","summary":"Malicious code in nj-logger (npm)","details":"nj-logger is a malicious npm package that when imported in file dist/logger/telemetry.js downloads a trojan (for Windows only, W64.AIDetectMalware / Trojan.Malware.300983.susgen) from http://178.128.88[.]40:8080/download/svc to path node_modules/.cache/nj-logger/nj-transport-win32-x64.node and executes it. Downloader is obfuscated as telemetry module, urls & paths are base64 and XOR encoded.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9)\nThe package nj-logger was found to contain malicious code.\n","affected":[{"package":{"name":"nj-logger","ecosystem":"npm","purl":"pkg:npm/nj-logger"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nj-logger/MAL-2026-2907.json"}}],"database_specific":{"iocs":{"urls":["http://178.128.88.40:8080/download/svc"]},"malicious-packages-origins":[{"import_time":"2026-04-23T20:49:04.387597334Z","modified_time":"2026-04-23T20:43:56Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9","source":"amazon-inspector"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"indece","contact":["https://indece.com"],"type":"FINDER"}]} \ No newline at end of file +{"schema_version":"1.9.2","id":"MAL-2026-2907","published":"2026-04-16T02:50:55Z","modified":"2026-11-11T01:30:04.260793519Z","aliases":["GHSA-6q28-3q3p-8x7c"],"summary":"Malicious code in nj-logger (npm)","details":"nj-logger is a malicious npm package that when imported in file dist/logger/telemetry.js downloads a trojan (for Windows only, W64.AIDetectMalware / Trojan.Malware.300983.susgen) from http://178.128.88[.]40:8080/download/svc to path node_modules/.cache/nj-logger/nj-transport-win32-x64.node and executes it. Downloader is obfuscated as telemetry module, urls & paths are base64 and XOR encoded.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9)\nThe package nj-logger was found to contain malicious code.\n\n## Source: ghsa-malware (1d4672fb4d84dc0356e950e69c102c85477dbf05fffc2991a5bf974e3dd88ef6)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"nj-logger","ecosystem":"npm","purl":"pkg:npm/nj-logger"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nj-logger/MAL-2026-2907.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6q28-3q3p-8x7c"}],"database_specific":{"iocs":{"urls":["http://178.128.88.40:8080/download/svc"]},"malicious-packages-origins":[{"import_time":"2026-04-23T20:49:04.387597334Z","modified_time":"2026-04-23T20:43:56Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"35414b2bda6d20336301bfdc5c0147a6434ee0e712f1fd5962a61ef34d6e53e9","source":"amazon-inspector"},{"id":"GHSA-6q28-3q3p-8x7c","import_time":"2026-11-11T01:16:44.035958687Z","modified_time":"2026-11-11T00:53:19Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"1d4672fb4d84dc0356e950e69c102c85477dbf05fffc2991a5bf974e3dd88ef6","source":"ghsa-malware"}]},"credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"},{"name":"indece","contact":["https://indece.com"],"type":"FINDER"}]} \ No newline at end of file diff --git a/state/sync.json b/state/sync.json index 005f60e277..41cf6934b3 100644 --- a/state/sync.json +++ b/state/sync.json @@ -1,16 +1,16 @@ { "ecosystems": { "GitHub Actions": { - "etag": "\"3ca17213380659bdefcd11edff2b720a\"", - "last_modified": "Tue, 10 Nov 2026 22:03:10 GMT", - "last_success": "2026-11-11T00:44:05.386760+00:00", + "etag": "\"2a2875980b44cc4367b5d2dc2a58eeea\"", + "last_modified": "Wed, 11 Nov 2026 03:02:52 GMT", + "last_success": "2026-11-11T06:43:59.100960+00:00", "records": 64 }, "Go": { - "etag": "\"8b32b5bf4804a25f0a77d469637bbcca\"", - "last_modified": "Tue, 10 Nov 2026 20:03:04 GMT", - "last_success": "2026-11-10T20:34:47.545516+00:00", - "records": 9935 + "etag": "\"949bb039db2e60272e08ecb125285faf\"", + "last_modified": "Wed, 11 Nov 2026 03:32:46 GMT", + "last_success": "2026-11-11T06:43:45.656876+00:00", + "records": 9947 }, "Maven": { "etag": "\"6fbed40322e2ad6f43b25593d689832b\"", @@ -19,10 +19,10 @@ "records": 7257 }, "NuGet": { - "etag": "\"7f4385376a1ba9fec92d7e12db7f8ffc\"", - "last_modified": "Wed, 11 Nov 2026 00:33:11 GMT", - "last_success": "2026-11-11T00:43:52.952031+00:00", - "records": 1996 + "etag": "\"c76fac74db56f69956b194e011fcf6c0\"", + "last_modified": "Wed, 11 Nov 2026 01:17:51 GMT", + "last_success": "2026-11-11T06:43:52.614939+00:00", + "records": 2010 }, "OSS-Fuzz": { "etag": "\"121d45b88a3a072c5385693bbdaef2e4\"", @@ -37,9 +37,9 @@ "records": 7422 }, "PyPI": { - "etag": "\"f7930173acc4ad197b1bf6253ba36219\"", - "last_modified": "Tue, 10 Nov 2026 22:18:00 GMT", - "last_success": "2026-11-11T00:41:40.309754+00:00", + "etag": "\"173a45dd51b7d52ca52da6fc4170b3fe\"", + "last_modified": "Wed, 11 Nov 2026 03:02:53 GMT", + "last_success": "2026-11-11T06:41:36.296745+00:00", "records": 26860 }, "RubyGems": { @@ -55,10 +55,10 @@ "records": 3081 }, "npm": { - "etag": "\"a8f055f04d4913e130211860288bb8a5\"", - "last_modified": "Tue, 10 Nov 2026 23:33:02 GMT", - "last_success": "2026-11-11T00:43:48.021698+00:00", - "records": 231651 + "etag": "\"fb52c38d1f574b47ead3e79c1b3a5594\"", + "last_modified": "Wed, 11 Nov 2026 04:32:56 GMT", + "last_success": "2026-11-11T06:43:33.882735+00:00", + "records": 231665 } }, "version": 1