Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.dotnet.hotreload.watch.aspire

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetAmendedPublished

    Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability

    CVE-2026-114155 · GHSA-q7j6-px74-p2vw

    Affected
    • NuGet microsoft.dotnet.hotreload.watch.aspire >= 10.0.300, < 10.0.404; >= 10.0.400, < 10.0.404; >= 11.0.100-preview.3.26207.106, < 11.0.100
    Fixed in
    10.0.40411.0.100· Vendor fix available
    Issue
    Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations. A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C` - Weakness: CWE-367 - MSRC severity: Important - Impact: Elevation of Privilege Affected Platforms - Platforms: Linux, macOS. - Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64 Windows is outside this…

    Recommended action: Upgrade to 11.0.100 or 10.0.404 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →