Read the docs
TI-2024-24816 Aliases CVE-2024-37304

NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00651 51st percentileScored 2026-11-07
Fix Fixed NuGetGallery (NuGet): 2024.05.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftNuGetGallerybefore 2024.05.282024.05.28Patch availableCNA
  • NuGetGallery VendorMicrosoft Affected before 2024.05.28 Fixed in 2024.05.28 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:*before 2024.05.28VulnerableMicrosoft
  • cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:* Versions before 2024.05.28 Vulnerable ·Microsoft

Remediation

  • Fix · CNA NuGetGallery (NuGet) Fixed in 2024.05.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-37304
  2. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2024-36254 XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing CVSS 4.0MEDIUM 6.9
  • TI-2024-31884 XSS vulnerability in NuGetGallery HTML attributes handling CVSS 3.1HIGH 8.2
  • TI-2020-01301 Cross-site scripting in Microsoft NuGetGallery CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences