GHSA-g4vj-cjjj-v7hg

Source

https://github.com/advisories/GHSA-g4vj-cjjj-v7hg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g4vj-cjjj-v7hg

Downstream

CGA (148)

MINI (5)

Published

2026-04-14T23:42:30Z

Modified

2026-09-10T03:50:48Z

Summary

Defense in Depth update for NuGet Client

Details

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

Affected versions	Patched version
>= 4.9.0, <= 4.9.6	4.9.7
>= 5.11.0, <= 5.11.6	5.11.7
>= 6.8.0, <= 6.8.1	6.8.2
>= 6.11.0, <= 6.11.1	6.11.2
>= 6.12.0, <= 6.12.4	6.12.5
>= 6.14.0, <= 6.14.2	6.14.3
>= 7.0.0, <= 7.0.2	7.0.3
7.3.0	7.3.1

.NET SDK

.NET 8.0.126 SDK
.NET 8.0.420 SDK
.NET 9.0.116 SDK
.NET 9.0.313 SDK
.NET 10.0.106 SDK
.NET 10.0.202 SDK

Workarounds

N/A

References

https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Credit

splitline with DEVCORE

Database specific

{
    "cwe_ids":  [
        "CWE-345"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-14T23:42:30Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

NuGet

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.9.0

Fixed

4.9.7

Database specific

last_known_affected_version_range

"<= 4.9.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.11.7

Affected versions

5.*

5.11.0

5.11.2

5.11.3

5.11.5

5.11.6

Database specific

last_known_affected_version_range

"<= 5.11.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.8.0

Fixed

6.8.2

Affected versions

6.*

6.8.0

6.8.1

Database specific

last_known_affected_version_range

"<= 6.8.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.11.0

Fixed

6.11.2

Affected versions

6.*

6.11.0

6.11.1

Database specific

last_known_affected_version_range

"<= 6.11.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.12.0

Fixed

6.12.5

Affected versions

6.*

6.12.0

6.12.1

6.12.4

Database specific

last_known_affected_version_range

"<= 6.12.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.14.0

Fixed

6.14.3

Affected versions

6.*

6.14.0

Database specific

last_known_affected_version_range

"<= 6.14.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.3

Affected versions

7.*

7.0.0

7.0.1

Database specific

last_known_affected_version_range

"<= 7.0.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Packaging

Package

Name: NuGet.Packaging; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Packaging

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.3.0

Fixed

7.3.1

Affected versions

7.*

7.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.9.0

Fixed

4.9.7

Database specific

last_known_affected_version_range

"<= 4.9.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.11.7

Affected versions

5.*

5.11.0

5.11.2

5.11.3

5.11.5

5.11.6

Database specific

last_known_affected_version_range

"<= 5.11.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.8.0

Fixed

6.8.2

Affected versions

6.*

6.8.0

6.8.1

Database specific

last_known_affected_version_range

"<= 6.8.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.11.0

Fixed

6.11.2

Affected versions

6.*

6.11.0

6.11.1

Database specific

last_known_affected_version_range

"<= 6.11.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.12.0

Fixed

6.12.5

Affected versions

6.*

6.12.0

6.12.1

6.12.4

Database specific

last_known_affected_version_range

"<= 6.12.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.14.0

Fixed

6.14.3

Affected versions

6.*

6.14.0

Database specific

last_known_affected_version_range

"<= 6.14.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.3

Affected versions

7.*

7.0.0

7.0.1

Database specific

last_known_affected_version_range

"<= 7.0.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.Protocol

Package

Name: NuGet.Protocol; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.Protocol

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.3.0

Fixed

7.3.1

Affected versions

7.*

7.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.9.0

Fixed

4.9.7

Affected versions

4.*

4.9.2

4.9.3

4.9.4

4.9.5

4.9.6

Database specific

last_known_affected_version_range

"<= 4.9.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.11.7

Affected versions

5.*

5.11.0

5.11.2

5.11.3

5.11.5

5.11.6

Database specific

last_known_affected_version_range

"<= 5.11.6"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.8.0

Fixed

6.8.2

Affected versions

6.*

6.8.0

6.8.1

Database specific

last_known_affected_version_range

"<= 6.8.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.11.0

Fixed

6.11.2

Affected versions

6.*

6.11.0

6.11.1

Database specific

last_known_affected_version_range

"<= 6.11.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.12.0

Fixed

6.12.5

Affected versions

6.*

6.12.0

6.12.1

6.12.2

6.12.4

Database specific

last_known_affected_version_range

"<= 6.12.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.14.0

Fixed

6.14.3

Affected versions

6.*

6.14.0

Database specific

last_known_affected_version_range

"<= 6.14.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.3

Affected versions

7.*

7.0.0

7.0.1

Database specific

last_known_affected_version_range

"<= 7.0.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"

NuGet.CommandLine

Package

Name: NuGet.CommandLine; View open source insights on deps.dev
Purl: pkg:nuget/NuGet.CommandLine

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.3.0

Fixed

7.3.1

Affected versions

7.*

7.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"