PT-2026-32962 · Microsoft · Nuget Gallery

Chabiss · Published 2026-04-14 · Updated 2026-04-15 · CVE-2026-39399

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions NuGet Gallery (affected versions not specified)

Description A flaw exists in the NuGetGallery backend job regarding the handling of .nuspec files within NuGet packages. Due to insufficient input validation, an attacker can provide a crafted .nuspec file containing malicious metadata. This leads to cross package metadata injection via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. Consequently, this can result in remote code execution (RCE) and arbitrary blob writes within the storage container, enabling the tampering of existing content beyond .nupkg files.

Recommendations Apply the fix provided in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2026-39399

Affected Products

Nuget Gallery

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-39399 · Security Note
• https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr · Note
• https://github.com/NuGet/NuGetGallery/commit/0e80f87628349207cdcaf55358491f8a6f1ca276 · Note
• https://twitter.com/0dayPublishing/status/2044195165271646259 · Twitter Post
• https://twitter.com/integ_sec/status/2044450738282037566 · Twitter Post
• https://twitter.com/CVEnew/status/2044338873476792378 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2044228745607688281 · Twitter Post
• https://twitter.com/CCBalert/status/2044413032118301006 · Twitter Post