CVE-2026-39399
Cross Package Metadata Injection in NuGetGallery Enables RCE
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nuget | nuget_gallery | to 0e80f87628349207cdcaf55358491f8a6f1ca276 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the NuGetGallery backend job's handling of .nuspec files within NuGet packages. An attacker can supply a specially crafted nuspec file containing malicious metadata, which leads to cross package metadata injection. This injection can result in remote code execution (RCE) and/or arbitrary blob writes because the input validation is insufficient.
The attack exploits URI fragment injection using unsanitized package identifiers, allowing the attacker to control the resolved blob path. This means the attacker can write to arbitrary blobs within the storage container, not just .nupkg files, potentially tampering with existing content.
The vulnerability has been patched in a specific commit to fix this issue.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including remote code execution (RCE), which allows an attacker to run arbitrary code on the server hosting the NuGetGallery backend.
Additionally, the attacker can perform arbitrary blob writes within the storage container, potentially tampering with existing package content or other stored data.
Such impacts can compromise the integrity and availability of the package repository, leading to trust issues and possible disruption of software supply chains.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276. Immediate mitigation steps include applying this patch to the NuGetGallery backend job to ensure proper input validation of .nuspec files and prevent cross package metadata injection.