{"id":"GHSA-6r78-m64m-qwcf","aliases":[],"status":"published","title":"Moq v4.20.0-rc to 4.20.1 share hashed user data","description":"Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.\n\nMoq v4.20.2 has removed this functionality.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-10T19:25:23Z","modified":"2024-12-01T05:31:02Z","fixes":[{"ecosystem":"NuGet","package":"moq","fixed_in":["4.20.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"moq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0-rc"},{"fixed":"4.20.2"}]}]},{"source":"osv","ecosystem":"NuGet","package":"moq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0-rc"},{"fixed":"4.20.2"}]}],"versions":["4.20.0","4.20.0-rc","4.20.1"]}],"references":[{"url":"https://github.com/moq/moq/issues/1374","tags":["web"]},{"url":"https://github.com/moq/moq/pull/1363","tags":["web"]},{"url":"https://github.com/moq/moq/pull/1375","tags":["web"]},{"url":"https://www.cazzulino.com/sponsorlink.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6r78-m64m-qwcf"},{"url":"https://github.com/moq/moq","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-6r78-m64m-qwcf","title":"Moq v4.20.0-rc to 4.20.1 share hashed user data","description":"Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.\n\nMoq v4.20.2 has removed this functionality.","status":"published","published":"2023-08-10T19:25:23Z","modified":"2023-08-25T18:58:28Z","updated_at":"2026-11-02T14:37:00.680009Z"}],"osv":[{"id":"GHSA-6r78-m64m-qwcf","title":"Moq v4.20.0-rc to 4.20.1 share hashed user data","description":"Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.\n\nMoq v4.20.2 has removed this functionality.","status":"published","published":"2023-08-10T19:25:23Z","modified":"2024-12-01T05:31:02.237947Z","updated_at":"2026-11-02T15:46:39.965326Z"}]}}