CVE-2026-39399
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
NuGet Gallery is a package repository. A backend job processing .nuspec files lacks input validation. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross-package metadata injection, resulting in remote code execution and arbitrary blob writes in the storage container.
Risk Assessment
An attacker can remotely execute code on the server and manipulate arbitrary blobs in the storage container, potentially compromising data integrity.
Recommendation
Apply the patch from commit 0e80f87628349207cdcaf55358491f8a6f1ca276 or update NuGet Gallery.
Original NVD description (English source)
NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. This enables writes to arbitrary blobs within the storage container, not limited to .nupkg files, resulting in potential tampering of existing content. This issue has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.