Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.testplatform.cli

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetPublished

    Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability

    GHSA-6856-87hx-p5x7

    Affected
    • NuGet microsoft.testplatform.cli >= 17.2.0-preview-20220301-01, < 17.3.4; >= 17.3.1, < 17.3.4; >= 17.3.2, < 17.3.4; >= 17.3.3, < 17.3.4; >= 17.8.0, < 17.8.1; >= 17.11.0, < 17.11.2; >= 17.11.1, < 17.11.2; >= 17.12.0, < 17.12.1; >= 17.14.0, < 17.14.2; >= 17.14.1, < 17.14.2; >= 18.0.0, < 18.0.2; >= 18.0.1, < 18.0.2; >= 18.7.0, < 18.7.1; >= 18.10.0, < 18.10.2; >= 18.10.1, < 18.10.2; >= 18.11.0, < 18.11.1; >= 17.4.0, <= 17.4.0; >= 17.4.1, <= 17.4.1; >= 17.5.0, <= 17.5.0; >= 17.6.0, <= 17.6.0; >= 17.6.1, <= 17.6.1; >= 17.6.2, <= 17.6.2; >= 17.6.3, <= 17.6.3; >= 17.7.0, <= 17.7.0; >= 17.7.1, <= 17.7.1; >= 17.7.2, <= 17.7.2; >= 17.9.0, <= 17.9.0; >= 17.10.0, <= 17.10.0; >= 17.13.0, <= 17.13.0; >= 18.3.0, <= 18.3.0; >= 18.4.0, <= 18.4.0; >= 18.5.0, <= 18.5.0; >= 18.5.1, <= 18.5.1; >= 18.6.0, <= 18.6.0; >= 18.8.0, <= 18.8.0; >= 18.8.1, <= 18.8.1; >= 18.9.0, <= 18.9.0; >= 17.4.0-preview-20220707-01, <= 17.4.0-preview-20220707-01; >= 17.4.0-preview-20220726-02, <= 17.4.0-preview-20220726-02; >= 17.4.0-preview-20221003-03, <= 17.4.0-preview-20221003-03; >= 17.4.0-release-20220926-01, <= 17.4.0-release-20220926-01; >= 17.5.0-preview-20221003-04, <= 17.5.0-preview-20221003-04; >= 17.5.0-preview-20221221-03, <= 17.5.0-preview-20221221-03; >= 17.6.0-preview-20230223-05, <= 17.6.0-preview-20230223-05; >= 17.7.0-preview-23364-03, <= 17.7.0-preview-23364-03; >= 17.7.0-preview.23280.1, <= 17.7.0-preview.23280.1; >= 17.8.0-preview-23371-04, <= 17.8.0-preview-23371-04; >= 17.8.0-preview-23424-02, <= 17.8.0-preview-23424-02; >= 17.8.0-release-23468-02, <= 17.8.0-release-23468-02; >= 17.9.0-preview-23503-02, <= 17.9.0-preview-23503-02; >= 17.9.0-preview-23531-01, <= 17.9.0-preview-23531-01; >= 17.9.0-preview-23577-04, <= 17.9.0-preview-23577-04; >= 17.9.0-release-23619-01, <= 17.9.0-release-23619-01; >= 17.10.0-preview-24080-01, <= 17.10.0-preview-24080-01; >= 17.10.0-release-24177-07, <= 17.10.0-release-24177-07; >= 17.11.0-release-24352-06, <= 17.11.0-release-24352-06; >= 17.11.0-release-24373-02, <= 17.11.0-release-24373-02; >= 17.14.0-preview-25107-01, <= 17.14.0-preview-25107-01; >= 17.3.0, < 17.3.4
    Fixed in
    18.10.218.7.117.8.117.3.417.12.117.14.218.11.117.11.218.0.2· Partial vendor fix
    Issue
    Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. The VSTest artifact postprocessor can consume a forged `executionComplete.json` from another local user and execute attacker-controlled output handling. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/517 CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C` - Weakness: CWE-284 Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All Affected Packages The tables list affected versions of Microsoft.TestPlatform.CLI and their patched versions. The VSTest CLI is also bundled in the .NET SDK; SDK versions are listed separately below. Updating a separately installed CLI package does not…

    Recommended action: Upgrade to 18.11.1, 18.10.2, 18.7.1 or 6 more by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →