GHSA-hfpm-4fc4-g2wc

Source

https://github.com/advisories/GHSA-hfpm-4fc4-g2wc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hfpm-4fc4-g2wc

Withdrawn

2026-11-10T22:17:41Z

Published

2026-11-10T21:33:43Z

Modified

2026-11-10T22:30:03Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.

Original Description

Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.

Database specific

{
    "cwe_ids": [
        "CWE-379"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-10T22:17:41Z",
    "nvd_published_at": "2026-11-10T19:20:26Z",
    "severity": "HIGH"
}

References

Affected packages

NuGet / Aspire.Cli

Package

Name: Aspire.Cli; View open source insights on deps.dev
Purl: pkg:nuget/Aspire.Cli

Affected ranges

Type: ECOSYSTEM
Events: Introduced

13.2.0

Affected versions

13.*

13.2.0

13.2.1

13.2.2

13.2.3

13.2.4

13.3.0

13.3.1

13.3.2

13.3.3

13.3.4

13.3.5

13.4.0

13.4.1

13.4.2

13.4.3

13.4.4

13.4.5

13.4.6

13.5.0

13.5.1

13.5.2

13.5.3

13.5.4

13.6.0

13.6.1

13.6.2

13.6.3

13.6.4

13.6.5

Database specific

last_known_affected_version_range

"< 13.6.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json"