Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

moq

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedNuGetPublished

    Moq v4.20.0-rc to 4.20.1 share hashed user data

    GHSA-6r78-m64m-qwcf

    Affected
    • NuGet moq >= 4.20.0-rc, < 4.20.2
    Fixed in
    4.20.2· Vendor fix available
    Issue
    Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local git config data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality.

    Recommended action: Upgrade to 4.20.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →