GHSA-g4vj-cjjj-v7hg

Defense in Depth update for NuGet Client

No scoreFix available

GHSA-g4vj-cjjj-v7hg is a vulnerability with no CVSS score yet in NuGet.Packaging, published April 14, 2026. No source lists public exploit code. Fixed in NuGet.Packaging 4.9.7.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 4.9.7NuGet.Packaging +47 more

Description

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version| |--|--| |>= 4.9.0, <= 4.9.6|4.9.7| |>= 5.11.0, <= 5.11.6|5.11.7| |>= 6.8.0, <= 6.8.1|6.8.2| |>= 6.11.0, <= 6.11.1|6.11.2| |>= 6.12.0, <= 6.12.4|6.12.5| |>= 6.14.0, <= 6.14.2|6.14.3| |>= 7.0.0, <= 7.0.2|7.0.3| |7.3.0|7.3.1|

.NET SDK

.NET 8.0.126 SDK
.NET 8.0.420 SDK
.NET 9.0.116 SDK
.NET 9.0.313 SDK
.NET 10.0.106 SDK
.NET 10.0.202 SDK

Workarounds

N/A

References

https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Credit

splitline with DEVCORE

Affected packages

Affected packages
Package	Affected	Fixed
`NuGet.Packaging` NuGet	4.9.0 to 4.9.6	4.9.7
`NuGet.Packaging` NuGet	5.11.0 to 5.11.6	5.11.7
`NuGet.Packaging` NuGet	6.8.0 to 6.8.1	6.8.2
`NuGet.Packaging` NuGet	6.11.0 to 6.11.1	6.11.2
`NuGet.Packaging` NuGet	6.12.0 to 6.12.4	6.12.5
`NuGet.Packaging` NuGet	6.14.0 to 6.14.2	6.14.3
`NuGet.Packaging` NuGet	7.0.0 to 7.0.2	7.0.3
`NuGet.Packaging` NuGet	7.3.0 to 7.3.0	7.3.1
`NuGet.Protocol` NuGet	4.9.0 to 4.9.6	4.9.7
`NuGet.Protocol` NuGet	5.11.0 to 5.11.6	5.11.7

Show 38 moreShow less

Affected packages
Package	Affected	Fixed
`NuGet.Protocol` NuGet	6.8.0 to 6.8.1	6.8.2
`NuGet.Protocol` NuGet	6.11.0 to 6.11.1	6.11.2
`NuGet.Protocol` NuGet	6.12.0 to 6.12.4	6.12.5
`NuGet.Protocol` NuGet	6.14.0 to 6.14.2	6.14.3
`NuGet.Protocol` NuGet	7.0.0 to 7.0.2	7.0.3
`NuGet.Protocol` NuGet	7.3.0 to 7.3.0	7.3.1
`NuGet.CommandLine` NuGet	4.9.0 to 4.9.6	4.9.7
`NuGet.CommandLine` NuGet	5.11.0 to 5.11.6	5.11.7
`NuGet.CommandLine` NuGet	6.8.0 to 6.8.1	6.8.2
`NuGet.CommandLine` NuGet	6.11.0 to 6.11.1	6.11.2
`NuGet.CommandLine` NuGet	6.12.0 to 6.12.4	6.12.5
`NuGet.CommandLine` NuGet	6.14.0 to 6.14.2	6.14.3
`NuGet.CommandLine` NuGet	7.0.0 to 7.0.2	7.0.3
`NuGet.CommandLine` NuGet	7.3.0 to 7.3.0	7.3.1
`NuGet.Packaging` NuGet	4.9.0 up to 4.9.7	4.9.7
`NuGet.Packaging` NuGet	5.11.0 up to 5.11.7, plus listed versions 5.11.25.11.35.11.55.11.6	5.11.7
`NuGet.Packaging` NuGet	6.8.0 up to 6.8.2, plus listed versions 6.8.1	6.8.2
`NuGet.Packaging` NuGet	6.11.0 up to 6.11.2, plus listed versions 6.11.1	6.11.2
`NuGet.Packaging` NuGet	6.12.0 up to 6.12.5, plus listed versions 6.12.16.12.4	6.12.5
`NuGet.Packaging` NuGet	6.14.0 up to 6.14.3	6.14.3
`NuGet.Packaging` NuGet	7.0.0 up to 7.0.3, plus listed versions 7.0.1	7.0.3
`NuGet.Packaging` NuGet	7.3.0 up to 7.3.1	7.3.1
`NuGet.Protocol` NuGet	4.9.0 up to 4.9.7	4.9.7
`NuGet.Protocol` NuGet	5.11.0 up to 5.11.7, plus listed versions 5.11.25.11.35.11.55.11.6	5.11.7
`NuGet.Protocol` NuGet	6.8.0 up to 6.8.2, plus listed versions 6.8.1	6.8.2
`NuGet.Protocol` NuGet	6.11.0 up to 6.11.2, plus listed versions 6.11.1	6.11.2
`NuGet.Protocol` NuGet	6.12.0 up to 6.12.5, plus listed versions 6.12.16.12.4	6.12.5
`NuGet.Protocol` NuGet	6.14.0 up to 6.14.3	6.14.3
`NuGet.Protocol` NuGet	7.0.0 up to 7.0.3, plus listed versions 7.0.1	7.0.3
`NuGet.Protocol` NuGet	7.3.0 up to 7.3.1	7.3.1
`NuGet.CommandLine` NuGet	4.9.0 up to 4.9.7, plus listed versions 4.9.24.9.34.9.44.9.54.9.6	4.9.7
`NuGet.CommandLine` NuGet	5.11.0 up to 5.11.7, plus listed versions 5.11.25.11.35.11.55.11.6	5.11.7
`NuGet.CommandLine` NuGet	6.8.0 up to 6.8.2, plus listed versions 6.8.1	6.8.2
`NuGet.CommandLine` NuGet	6.11.0 up to 6.11.2, plus listed versions 6.11.1	6.11.2
`NuGet.CommandLine` NuGet	6.12.0 up to 6.12.5, plus listed versions 6.12.16.12.26.12.4	6.12.5
`NuGet.CommandLine` NuGet	6.14.0 up to 6.14.3	6.14.3
`NuGet.CommandLine` NuGet	7.0.0 up to 7.0.3, plus listed versions 7.0.1	7.0.3
`NuGet.CommandLine` NuGet	7.3.0 up to 7.3.1	7.3.1

What each source reports

GitHub AdvisoriesNo score

Defense in Depth update for NuGet Client

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

.NET SDK

.NET 8.0.126 SDK
.NET 8.0.420 SDK
.NET 9.0.116 SDK
.NET 9.0.313 SDK
.NET 10.0.106 SDK
.NET 10.0.202 SDK

Workarounds

N/A

References

https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Credit

splitline with DEVCORE

Record: GHSA-g4vj-cjjj-v7hg
Weakness: CWE-345
Updated: 2026-11-02

OSVNo score

Defense in Depth update for NuGet Client

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

.NET SDK

.NET 8.0.126 SDK
.NET 8.0.420 SDK
.NET 9.0.116 SDK
.NET 9.0.313 SDK
.NET 10.0.106 SDK
.NET 10.0.202 SDK

Workarounds

N/A

References

https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Credit

splitline with DEVCORE

Record: GHSA-g4vj-cjjj-v7hg
Weakness: CWE-345
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.