GHSA-fgfw-85w4-gx99

Source

https://github.com/advisories/GHSA-fgfw-85w4-gx99

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fgfw-85w4-gx99

Withdrawn

2026-11-10T22:30:50Z

Published

2026-11-10T21:33:44Z

Modified

2026-11-10T22:45:03Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L CVSS Calculator

Summary

Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.

Original Description

Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.

Database specific

{
    "cwe_ids": [
        "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T22:30:50Z",
    "nvd_published_at": "2026-11-10T19:20:28Z",
    "severity": "HIGH"
}

References

Affected packages

NuGet / Aspire.Cli

Package

Name: Aspire.Cli; View open source insights on deps.dev
Purl: pkg:nuget/Aspire.Cli

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.2.0

Affected versions

13.*

13.2.0

13.2.1

13.2.2

13.2.3

13.2.4

13.3.0

13.3.1

13.3.2

13.3.3

13.3.4

13.3.5

13.4.0

13.4.1

13.4.2

13.4.3

13.4.4

13.4.5

13.4.6

13.5.0

13.5.1

13.5.2

13.5.3

13.5.4

13.6.0

13.6.1

13.6.2

13.6.3

13.6.4

13.6.5

Database specific

last_known_affected_version_range

"< 13.6.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-fgfw-85w4-gx99/GHSA-fgfw-85w4-gx99.json"