{"id":"GHSA-g4vj-cjjj-v7hg","aliases":[],"status":"published","title":"Defense in Depth update for NuGet Client","description":"### Impact\nThis update adds validation of the package ID and version during package download, in addition to the existing package signature validation.\n\n### Patches\n\n#### NuGet\n\nThe following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:\n\n|Affected versions|Patched version|\n|--|--|\n|\u003e= 4.9.0, \u003c= 4.9.6|4.9.7|\n|\u003e= 5.11.0, \u003c= 5.11.6|5.11.7|\n|\u003e= 6.8.0, \u003c= 6.8.1|6.8.2|\n|\u003e= 6.11.0, \u003c= 6.11.1|6.11.2|\n|\u003e= 6.12.0, \u003c= 6.12.4|6.12.5|\n|\u003e= 6.14.0, \u003c= 6.14.2|6.14.3|\n|\u003e= 7.0.0, \u003c= 7.0.2|7.0.3|\n|7.3.0|7.3.1|\n\n#### .NET SDK\n\n* .NET 8.0.126 SDK\n* .NET 8.0.420 SDK\n* .NET 9.0.116 SDK\n* .NET 9.0.313 SDK\n* .NET 10.0.106 SDK\n* .NET 10.0.202 SDK\n\n### Workarounds\nN/A\n\n### References\nhttps://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr\n\n### Credit\n[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2026-04-14T23:42:30Z","modified":"2026-09-10T03:50:48Z","fixes":[{"ecosystem":"NuGet","package":"NuGet.Packaging","fixed_in":["4.9.7","5.11.7","6.8.2","6.11.2","6.12.5","6.14.3","7.0.3","7.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"NuGet.Protocol","fixed_in":["4.9.7","5.11.7","6.8.2","6.11.2","6.12.5","6.14.3","7.0.3","7.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"NuGet","package":"NuGet.CommandLine","fixed_in":["4.9.7","5.11.7","6.8.2","6.11.2","6.12.5","6.14.3","7.0.3","7.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"last_affected":"4.9.6"},{"fixed":"4.9.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"last_affected":"5.11.6"},{"fixed":"5.11.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"last_affected":"6.8.1"},{"fixed":"6.8.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"last_affected":"6.11.1"},{"fixed":"6.11.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"last_affected":"6.12.4"},{"fixed":"6.12.5"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"last_affected":"6.14.2"},{"fixed":"6.14.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.2"},{"fixed":"7.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"last_affected":"4.9.6"},{"fixed":"4.9.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"last_affected":"5.11.6"},{"fixed":"5.11.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"last_affected":"6.8.1"},{"fixed":"6.8.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"last_affected":"6.11.1"},{"fixed":"6.11.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"last_affected":"6.12.4"},{"fixed":"6.12.5"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"last_affected":"6.14.2"},{"fixed":"6.14.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.2"},{"fixed":"7.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"last_affected":"4.9.6"},{"fixed":"4.9.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"last_affected":"5.11.6"},{"fixed":"5.11.7"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"last_affected":"6.8.1"},{"fixed":"6.8.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"last_affected":"6.11.1"},{"fixed":"6.11.2"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"last_affected":"6.12.4"},{"fixed":"6.12.5"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"last_affected":"6.14.2"},{"fixed":"6.14.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.2"},{"fixed":"7.0.3"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"last_affected":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.4"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.4"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.Protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}],"versions":["4.9.2","4.9.3","4.9.4","4.9.5","4.9.6"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.2","6.12.4"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"]},{"source":"osv","ecosystem":"NuGet","package":"NuGet.CommandLine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"]}],"references":[{"url":"https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-g4vj-cjjj-v7hg","tags":["web"]},{"url":"https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g4vj-cjjj-v7hg"},{"url":"https://github.com/NuGet/NuGet.Client","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g4vj-cjjj-v7hg","title":"Defense in Depth update for NuGet Client","description":"### Impact\nThis update adds validation of the package ID and version during package download, in addition to the existing package signature validation.\n\n### Patches\n\n#### NuGet\n\nThe following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:\n\n|Affected versions|Patched version|\n|--|--|\n|\u003e= 4.9.0, \u003c= 4.9.6|4.9.7|\n|\u003e= 5.11.0, \u003c= 5.11.6|5.11.7|\n|\u003e= 6.8.0, \u003c= 6.8.1|6.8.2|\n|\u003e= 6.11.0, \u003c= 6.11.1|6.11.2|\n|\u003e= 6.12.0, \u003c= 6.12.4|6.12.5|\n|\u003e= 6.14.0, \u003c= 6.14.2|6.14.3|\n|\u003e= 7.0.0, \u003c= 7.0.2|7.0.3|\n|7.3.0|7.3.1|\n\n#### .NET SDK\n\n* .NET 8.0.126 SDK\n* .NET 8.0.420 SDK\n* .NET 9.0.116 SDK\n* .NET 9.0.313 SDK\n* .NET 10.0.106 SDK\n* .NET 10.0.202 SDK\n\n### Workarounds\nN/A\n\n### References\nhttps://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr\n\n### Credit\n[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)","status":"published","published":"2026-04-14T23:42:30Z","modified":"2026-04-14T23:42:33Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"osv":[{"id":"GHSA-g4vj-cjjj-v7hg","title":"Defense in Depth update for NuGet Client","description":"### Impact\nThis update adds validation of the package ID and version during package download, in addition to the existing package signature validation.\n\n### Patches\n\n#### NuGet\n\nThe following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:\n\n|Affected versions|Patched version|\n|--|--|\n|\u003e= 4.9.0, \u003c= 4.9.6|4.9.7|\n|\u003e= 5.11.0, \u003c= 5.11.6|5.11.7|\n|\u003e= 6.8.0, \u003c= 6.8.1|6.8.2|\n|\u003e= 6.11.0, \u003c= 6.11.1|6.11.2|\n|\u003e= 6.12.0, \u003c= 6.12.4|6.12.5|\n|\u003e= 6.14.0, \u003c= 6.14.2|6.14.3|\n|\u003e= 7.0.0, \u003c= 7.0.2|7.0.3|\n|7.3.0|7.3.1|\n\n#### .NET SDK\n\n* .NET 8.0.126 SDK\n* .NET 8.0.420 SDK\n* .NET 9.0.116 SDK\n* .NET 9.0.313 SDK\n* .NET 10.0.106 SDK\n* .NET 10.0.202 SDK\n\n### Workarounds\nN/A\n\n### References\nhttps://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr\n\n### Credit\n[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)","status":"published","published":"2026-04-14T23:42:30Z","modified":"2026-09-10T03:50:48.975042212Z","cwes":["CWE-345"],"updated_at":"2026-11-02T15:46:47.119724Z"}]}}