nuget.commands

Open advisories

3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

1. High, CVSS 7.8NuGetPublished 11 Oct 2022

   NuGet Elevation of Privilege Vulnerability

   CVE-2022-41032 · GHSA-g3q9-xf95-8hp5

   Affected

   • NuGet nuget.commands >= 4.6.0, < 4.9.6; >= 5.0.0, < 5.7.3; >= 5.8.0, < 5.9.3; >= 5.10.0, < 5.11.3; >= 6.0.0, < 6.0.3; >= 6.1.0, < 6.2.2; >= 6.3.0, < 6.3.1

   Fixed in

   6.0.34.9.65.7.35.11.36.3.16.2.25.9.3· Vendor fix available

   Issue

   Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 7.0.0-rc, .NET 6.0, .NET Core 3.1, and NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 7.0.0-rc.1, .NET 6.0, .NET Core 3.1, and NuGet clients (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol) where a malicious actor could cause a user to execute arbitrary code. Affected software NuGet & NuGet Packages - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.3.0 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.2.1 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 6.0.2 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.Protocol 5.11.2 version or earlier. - Any NuGet.exe,…

   Recommended action: Upgrade to 6.3.1, 6.2.2, 6.0.3 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 17:03 UTCEvidence →
2. Medium, CVSS 5.5NuGetPublished 14 Jun 2022

   Potential leak of NuGet.org API key

   CVE-2022-30184 · GHSA-3885-8gqc-3wpf

   Affected

   • NuGet nuget.commands >= 3.5.0, < 4.9.5; >= 5.0.0, < 5.2.1; >= 5.3.0, < 5.7.2; >= 5.8.0, < 5.9.2; >= 5.10.0, < 5.11.2; >= 6.0.0, < 6.0.2; >= 6.1.0, < 6.2.1

   Fixed in

   5.7.25.2.16.2.15.9.24.9.55.11.26.0.2· Vendor fix available

   Issue

   Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET Core 3.1, NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 6.0, .NET Core 3.1, and NuGet (NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat version range from 3.5.0 to 6.2.0) where a nuget.org api key could leak due to an incorrect comparison with a server url. Affected software NuGet & NuGet Packages - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 6.2.0 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 6.0.1 version or earlier. - Any NuGet.exe, NuGet.Commands, NuGet.CommandLine, NuGet.CommandLine.XPlat 5.11.1 version or earlier. - Any NuGet.exe,…

   Recommended action: Upgrade to 6.2.1, 6.0.2, 5.11.2 or 4 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 17:03 UTCEvidence →
3. Medium, CVSS 5.5NuGetPublished 24 May 2022

   NuGet Package Manager Tampering Vulnerability

   CVE-2019-0976 · GHSA-3hcm-6fjc-47qq

   Affected

   • NuGet nuget.commands >= 5.0.0, < 5.0.2

   Fixed in

   5.0.2· Vendor fix available

   Issue

   A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default obj), aka 'NuGet Package Manager Tampering Vulnerability'.

   Recommended action: Upgrade to 5.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

   Sources:github.comSource checked 26 Oct 2026, 17:00 UTCEvidence →