GHSA-q7j6-px74-p2vw

Suggest an improvement
Source
https://github.com/advisories/GHSA-q7j6-px74-p2vw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q7j6-px74-p2vw
Aliases
  • CVE-2026-114155
Published
2026-11-11T00:09:46Z
Modified
2026-11-11T00:15:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C CVSS Calculator
Summary
Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability
Details

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.

A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5 (base score)
  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
  • Weakness: CWE-367
  • MSRC severity: Important
  • Impact: Elevation of Privilege

Affected Platforms

  • Platforms: Linux, macOS.
  • Architectures: Linux: Arm, Arm64, x64; macOS: Arm64, x64

Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.

Affected Packages

The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.

Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.

.NET SDK 10.0.3xx

Package Affected version Patched version
.NET SDK (dotnet-watch) 10.0.3xx >= 10.0.300, <= 10.0.303 10.0.404

.NET SDK 10.0.4xx

Package Affected version Patched version
.NET SDK (dotnet-watch) 10.0.4xx >= 10.0.400, <= 10.0.403 10.0.404

.NET SDK 11.0.1xx

Package Affected version Patched version
.NET SDK (dotnet-watch) 11.0.1xx >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 11.0.100

Separately restored Aspire watch tool

Package Affected version Patched version
Microsoft.DotNet.HotReload.Watch.Aspire >= 10.0.300, <= 10.0.303 10.0.404
Microsoft.DotNet.HotReload.Watch.Aspire >= 10.0.400, <= 10.0.403 10.0.404
Microsoft.DotNet.HotReload.Watch.Aspire >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 11.0.100

This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.

Advisory FAQ

How do I know if I am affected?

Run dotnet --version from the directory where you run dotnet-watch to identify the selected SDK. Use dotnet --info and dotnet --list-sdks to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable global.json, including its version and rollForward settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See .NET SDK selection.

Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.

How do I fix the issue?

The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs installed through Visual Studio, update Visual Studio to a release that includes a fixed SDK. Updating only an application runtime does not replace SDK-bundled tools.

Ensure that global.json and its SDK roll-forward policy select a fixed SDK, then rerun dotnet --version in the working directory to verify the selection. The SDK-bundled watch tool is installed beneath that selected SDK's DotnetTools/dotnet-watch directory.

If Microsoft.DotNet.HotReload.Watch.Aspire is restored separately, update its package reference or the consuming tool's version configuration to 10.0.404 or 11.0.100, as applicable, restore the tool, and restart the consuming process. An SDK update alone does not update that restored copy.

Other Information

Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

External Links

CVE-2026-114155

Acknowledgements

Revisions

V1.0 (November 10, 2026): Advisory published.

Database specific 
{
    "cwe_ids": [
        "CWE-367"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-11T00:09:46Z",
    "nvd_published_at": "2026-11-10T19:19:08Z",
    "severity": "MODERATE"
}
References

Affected packages

NuGet
Microsoft.DotNet.HotReload.Watch.Aspire

Package

Name
Microsoft.DotNet.HotReload.Watch.Aspire
View open source insights on deps.dev
Purl
pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.0.300
Fixed
10.0.404

Affected versions

10.*
10.0.300
10.0.301
10.0.302
10.0.303
10.0.400
10.0.401
10.0.402
10.0.403

Database specific

last_known_affected_version_range 
"<= 10.0.303"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"
Microsoft.DotNet.HotReload.Watch.Aspire

Package

Name
Microsoft.DotNet.HotReload.Watch.Aspire
View open source insights on deps.dev
Purl
pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.0.400
Fixed
10.0.404

Affected versions

10.*
10.0.400
10.0.401
10.0.402
10.0.403

Database specific

last_known_affected_version_range 
"<= 10.0.403"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"
Microsoft.DotNet.HotReload.Watch.Aspire

Package

Name
Microsoft.DotNet.HotReload.Watch.Aspire
View open source insights on deps.dev
Purl
pkg:nuget/Microsoft.DotNet.HotReload.Watch.Aspire

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.100-preview.3.26207.106
Fixed
11.0.100

Database specific

last_known_affected_version_range 
"<= 11.0.100-rc.3.26522.148"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-q7j6-px74-p2vw/GHSA-q7j6-px74-p2vw.json"