Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

aspire.hosting.apphost

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetAmendedPublished

    Microsoft Security Advisory CVE-2026-120006 - Aspire Elevation of Privilege Vulnerability

    CVE-2026-120006 · GHSA-f7vh-h5g3-7jrh

    Affected
    • NuGet aspire.hosting.apphost < 13.6.5
    Fixed in
    13.6.5· Vendor fix available
    Issue
    Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Aspire. This advisory provides guidance on updating affected applications and components. Disclosure of an Aspire Dashboard authentication cookie to a linked service can allow an attacker-controlled container to replay the authenticated session and execute code as the host developer. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/503 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 - Vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H` - Weakness: CWE-201 (Insertion of Sensitive Information Into Sent Data) Affected Platforms - Platforms: macOS - Architectures: x64, Arm64 Affected Packages Standalone Aspire Package | Affected version | Patched version --- | --- | --- Aspire.Hosting.AppHost | How do I know…

    Recommended action: Upgrade to 13.6.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →