Read the docs
TI-2026-66583 Aliases GHSA-g4vj-cjjj-v7hg

Defense in Depth update for NuGet Client

Priority LOW 38CWE-345Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-345.

Summary

### Impact This update adds validation of the package ID and version during package download, in addition to the existing package signature validation. ### Patches #### NuGet The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched: |Affected versions|Patched version| |--|--| |>= 4.9.0, <= 4.9.6|4.9.7| |>= 5.11.0, <= 5.11.6|5.11.7| |>= 6.8.0, <= 6.8.1|6.8.2| |>= 6.11.0, <= 6.11.1|6.11.2| |>= 6.12.0, <= 6.12.4|6.12.5| |>= 6.14.0, <= 6.14.2|6.14.3| |>= 7.0.0, <= 7.0.2|7.0.3| |7.3.0|7.3.1| #### .NET SDK * .NET 8.0.126 SDK * .NET 8.0.420 SDK * .NET 9.0.116 SDK * .NET 9.0.313 SDK * .NET 10.0.106 SDK * .NET 10.0.202 SDK ### Workarounds N/A ### References https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr ### Credit [splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)

Why it matters now

Fix Fixed NuGet.Packaging (NuGet): 4.9.7, 5.11.7, 6.8.2 +5NuGet.Protocol (NuGet): 4.9.7, 5.11.7, 6.8.2 +5+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—NuGet.Packaging (NuGet)4.9.0 to before 4.9.74.9.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)5.11.0 to before 5.11.75.11.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)6.8.0 to before 6.8.26.8.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)6.11.0 to before 6.11.26.11.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)6.12.0 to before 6.12.56.12.5Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)6.14.0 to before 6.14.36.14.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)7.0.0 to before 7.0.37.0.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Packaging (NuGet)7.3.0 to before 7.3.17.3.1Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)4.9.0 to before 4.9.74.9.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)5.11.0 to before 5.11.75.11.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)6.8.0 to before 6.8.26.8.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)6.11.0 to before 6.11.26.11.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)6.12.0 to before 6.12.56.12.5Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)6.14.0 to before 6.14.36.14.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)7.0.0 to before 7.0.37.0.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.Protocol (NuGet)7.3.0 to before 7.3.17.3.1Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)4.9.0 to before 4.9.74.9.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)5.11.0 to before 5.11.75.11.7Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)6.8.0 to before 6.8.26.8.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)6.11.0 to before 6.11.26.11.2Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)6.12.0 to before 6.12.56.12.5Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)6.14.0 to before 6.14.36.14.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)7.0.0 to before 7.0.37.0.3Patch availableGHSA-g4vj-cjjj-v7hg
—NuGet.CommandLine (NuGet)7.3.0 to before 7.3.17.3.1Patch availableGHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 4.9.0 to before 4.9.7 Fixed in 4.9.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 5.11.0 to before 5.11.7 Fixed in 5.11.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 6.8.0 to before 6.8.2 Fixed in 6.8.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 6.11.0 to before 6.11.2 Fixed in 6.11.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 6.12.0 to before 6.12.5 Fixed in 6.12.5 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 6.14.0 to before 6.14.3 Fixed in 6.14.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 7.0.0 to before 7.0.3 Fixed in 7.0.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Packaging (NuGet) Vendor— Affected 7.3.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 4.9.0 to before 4.9.7 Fixed in 4.9.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 5.11.0 to before 5.11.7 Fixed in 5.11.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 6.8.0 to before 6.8.2 Fixed in 6.8.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 6.11.0 to before 6.11.2 Fixed in 6.11.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 6.12.0 to before 6.12.5 Fixed in 6.12.5 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 6.14.0 to before 6.14.3 Fixed in 6.14.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 7.0.0 to before 7.0.3 Fixed in 7.0.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.Protocol (NuGet) Vendor— Affected 7.3.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 4.9.0 to before 4.9.7 Fixed in 4.9.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 5.11.0 to before 5.11.7 Fixed in 5.11.7 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 6.8.0 to before 6.8.2 Fixed in 6.8.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 6.11.0 to before 6.11.2 Fixed in 6.11.2 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 6.12.0 to before 6.12.5 Fixed in 6.12.5 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 6.14.0 to before 6.14.3 Fixed in 6.14.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 7.0.0 to before 7.0.3 Fixed in 7.0.3 Patch available GHSA-g4vj-cjjj-v7hg
  • NuGet.CommandLine (NuGet) Vendor— Affected 7.3.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-g4vj-cjjj-v7hg

Remediation

  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 4.9.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 5.11.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 6.8.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 6.11.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 6.12.5 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 6.14.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 7.0.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Packaging (NuGet) Fixed in 7.3.1 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 4.9.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 5.11.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 6.8.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 6.11.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 6.12.5 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 6.14.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 7.0.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.Protocol (NuGet) Fixed in 7.3.1 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 4.9.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 5.11.7 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 6.8.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 6.11.2 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 6.12.5 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 6.14.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 7.0.3 Advisory →
  • Fix · GHSA-g4vj-cjjj-v7hg NuGet.CommandLine (NuGet) Fixed in 7.3.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-g4vj-cjjj-v7hg

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences