TI-2019-00715 Aliases CVE-2019-0976 GHSA-3hcm-6fjc-47qq

Incorrect permission assignment in Microsoft Nuget

LOW 27CWE-732Published 2019-05-16 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that could allow an authenticated attacker to modify contents of the intermediate build folder (by default "obj"), aka 'NuGet Package Manager Tampering Vulnerability'.

Why it matters now

EPSS 0.01151 67th percentileScored 2026-11-07

Fix Fixed NuGet.Commands (NuGet): 5.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Nuget	5.0.2	—	No fix listed	CNA
—	NuGet.Commands (NuGet)	5.0.0 to before 5.0.2	5.0.2	Patch available	GHSA-3hcm-6fjc-47qq

Nuget VendorMicrosoft Affected 5.0.2 Fixed in — No fix listed CNA
NuGet.Commands (NuGet) Vendor— Affected 5.0.0 to before 5.0.2 Fixed in 5.0.2 Patch available GHSA-3hcm-6fjc-47qq

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:nuget:5.0.2:::::::*	5.0.2	Vulnerable	Microsoft
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux

cpe:2.3:a:microsoft:nuget:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Microsoft
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

Fix · GHSA-3hcm-6fjc-47qq NuGet.Commands (NuGet) Fixed in 5.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2019-0976
2026-10-03 Alias added: GHSA-3hcm-6fjc-47qq

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0976

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2019-0976

Other 4

TI-2019-00979 Azure Active Directory Authentication Library Elevation of Privilege Vulnerability CVSS 3.0HIGH 8.8
TI-2023-13731 NuGet Client Remote Code Execution Vulnerability CVSS 3.1HIGH 7.1
TI-2022-12453 .NET and Visual Studio Information Disclosure Vulnerability CVSS 3.1MEDIUM 5.5
TI-2019-00525 A tampering vulnerability exists in the NuGet Package Manager for Linux and Mac that… CVSS 3.1MEDIUM 6.5
TI-2022-19602 .NET Framework Information Disclosure Vulnerability CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences