PT-2024-36066 · Microsoft · Nuget Gallery

Lyndaidaii · Published 2024-12-06 · Updated 2025-09-05 · CVE-2024-54138

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: NuGet Gallery versions prior to 2024.12.06

Description: The NuGet Gallery has a security issue related to its handling of autolinks in Markdown content. Although the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks.

Recommendations: For versions prior to 2024.12.06, update to a version released on or after 2024.12.06 to resolve the issue. As a temporary workaround, consider disabling the handling of autolinks in Markdown content until a patch is available. Restrict access to Markdown content with autolinks to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-54138

GHSA-X448-P234-X5P8

Affected Products

Nuget Gallery

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/54xxx/CVE-2024-54138.json · Exploit
• https://github.com/NuGet/NuGetGallery/pull/10296 · Patch
• https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-x448-p234-x5p8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54138 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54138 · Vendor Advisory
• https://t.me/cvedetector/12285 · Telegram Post
• https://t.me/cveNotify/134428 · Telegram Post
• https://twitter.com/CVEnew/status/1865163147390390574 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1865190719440257516 · Twitter Post