N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-g4vj-cjjj-v7hg

GHSA-g4vj-cjjj-v7hg: Defense in Depth update for NuGet Client

Impact

This update adds validation of the package ID and version during package download, in addition to the existing package signature validation.

Patches

NuGet

The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:

|Affected versions|Patched version| |--|--| |>= 4.9.0, <= 4.9.6|4.9.7| |>= 5.11.0, <= 5.11.6|5.11.7| |>= 6.8.0, <= 6.8.1|6.8.2| |>= 6.11.0, <= 6.11.1|6.11.2| |>= 6.12.0, <= 6.12.4|6.12.5| |>= 6.14.0, <= 6.14.2|6.14.3| |>= 7.0.0, <= 7.0.2|7.0.3| |7.3.0|7.3.1|

.NET SDK

.NET 8.0.126 SDK
.NET 8.0.420 SDK
.NET 9.0.116 SDK
.NET 9.0.313 SDK
.NET 10.0.106 SDK
.NET 10.0.202 SDK

Workarounds

N/A

References

https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Credit

splitline with DEVCORE

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-g4vj-cjjj-v7hg

GHSA-g4vj-cjjj-v7hg:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
NuGet.Packaging	nuget	>= 4.9.0, <= 4.9.6	4.9.7
NuGet.Packaging	nuget	>= 5.11.0, <= 5.11.6	5.11.7
NuGet.Packaging	nuget	>= 6.8.0, <= 6.8.1	6.8.2
NuGet.Packaging	nuget	>= 6.11.0, <= 6.11.1	6.11.2
NuGet.Packaging	nuget	>= 6.12.0, <= 6.12.4	6.12.5
NuGet.Packaging	nuget	>= 6.14.0, <= 6.14.2	6.14.3
NuGet.Packaging	nuget	>= 7.0.0, <= 7.0.2	7.0.3
NuGet.Packaging	nuget	= 7.3.0	7.3.1
NuGet.Protocol	nuget	>= 4.9.0, <= 4.9.6	4.9.7
NuGet.Protocol	nuget	>= 5.11.0, <= 5.11.6	5.11.7
NuGet.Protocol	nuget	>= 6.8.0, <= 6.8.1	6.8.2
NuGet.Protocol	nuget	>= 6.11.0, <= 6.11.1	6.11.2
NuGet.Protocol	nuget	>= 6.12.0, <= 6.12.4	6.12.5
NuGet.Protocol	nuget	>= 6.14.0, <= 6.14.2	6.14.3
NuGet.Protocol	nuget	>= 7.0.0, <= 7.0.2	7.0.3
NuGet.Protocol	nuget	= 7.3.0	7.3.1
NuGet.CommandLine	nuget	>= 4.9.0, <= 4.9.6	4.9.7
NuGet.CommandLine	nuget	>= 5.11.0, <= 5.11.6	5.11.7
NuGet.CommandLine	nuget	>= 6.8.0, <= 6.8.1	6.8.2
NuGet.CommandLine	nuget	>= 6.11.0, <= 6.11.1	6.11.2
NuGet.CommandLine	nuget	>= 6.12.0, <= 6.12.4	6.12.5
NuGet.CommandLine	nuget	>= 6.14.0, <= 6.14.2	6.14.3
NuGet.CommandLine	nuget	>= 7.0.0, <= 7.0.2	7.0.3
NuGet.CommandLine	nuget	= 7.3.0	7.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-g4vj-cjjj-v7hg, is a defense-in-depth issue in the NuGet client where it failed to validate that the downloaded package's identity (ID and version) matched the requested package's identity. An attacker who could compromise a package repository or perform a man-in-the-middle attack could substitute a legitimate package with a malicious one, and the client would not detect the mismatch as long as other checks, like signature validation, passed.

The analysis of the patch commit 688e56d34b46f02bbc911489d664af529bdf3579 reveals the fix. The core of the patch is the introduction of two new validation methods: ValidateExpectedPackage in NuGet.Packaging and ValidatePackageIdentity in NuGet.Protocol. These methods are responsible for reading the nuspec metadata from the downloaded package stream and comparing its ID and version against the expected identity.

The patch applies this new validation logic across various code paths where packages are downloaded, copied, or installed. The identified vulnerable functions are the methods that were modified to include calls to these new validation routines. Before the patch, these functions would process package streams without this critical identity check, making them the entry points for the vulnerability. The affected functions span different scenarios, including direct HTTP downloads, access to local file-based repositories (V2, V3, and packages.config styles), and package extraction/installation.

Vulnerable functions

NuGet.Packaging.PackageExtractor.InstallFromSourceAsync

src/NuGet.Core/NuGet.Packaging/PackageExtractor.cs

This function is responsible for installing a package from a source. Prior to the patch, it did not validate that the downloaded package's ID and version matched the requested package's identity. This could allow a malicious actor to substitute a different package if they could compromise the package source.

NuGet.Packaging.PackageExtractor.CopySatelliteFilesAsync

src/NuGet.Core/NuGet.Packaging/PackageExtractor.cs

This function copies satellite assemblies from a package. It was vulnerable because it operated on a package stream without first verifying that the package identity matched the expected identity, creating a risk of using files from an incorrect or malicious package.

NuGet.Protocol.LocalDownloadResource.GetDownloadResourceResultAsync

src/NuGet.Core/NuGet.Protocol/LocalRepositories/LocalDownloadResource.cs

This function retrieves a package from a local repository. It was vulnerable because it would open a file stream to the package and return it for processing without verifying that the package's internal metadata (ID and version) matched what was requested.

NuGet.Protocol.LocalV3FindPackageByIdResource.CopyNupkgToStreamAsync

src/NuGet.Core/NuGet.Protocol/LocalRepositories/LocalV3FindPackageByIdResource.cs

This function copies a nupkg from a local V3-style repository to a stream. It was vulnerable as it did not validate the package's identity before copying, potentially allowing a mismatched or malicious package to be propagated.

NuGet.Protocol.FindPackagesByIdNupkgDownloader.ProcessHttpSourceResultAsync

src/NuGet.Core/NuGet.Protocol/Utility/FindPackagesByIdNupkgDownloader.cs

This function processes the result of an HTTP package download. The original validation (`ValidateNupkg`) was too generic and did not check for a match against the expected package identity. The patch replaced it with a specific identity validation, closing the vulnerability.

NuGet.Protocol.GetDownloadResultUtility.DirectDownloadAsync

src/NuGet.Core/NuGet.Protocol/Utility/GetDownloadResultUtility.cs

This function handles the direct download of a package. It was vulnerable because it would write the downloaded stream to a file but failed to validate the contents of that file against the expected package identity before returning it as a successful result.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-g4vj-cjjj-v7hg: Defense in Depth update for NuGet Client

Impact

Patches

NuGet

.NET SDK

Workarounds

References

Credit

GHSA-g4vj-cjjj-v7hg:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

GHSA-g4vj-cjjj-v7hg: Defense in Depth update for NuGet Client

Impact

Patches

NuGet

.NET SDK

Workarounds

References

Credit

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI