CVE-2026-39399

{
  "id": "CVE-2026-39399",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-39399",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-15T14:41:44.304732Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.6,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "NuGet",
          "product": "NuGetGallery",
          "versions": [
            {
              "status": "affected",
              "version": "< 0e80f87628349207cdcaf55358491f8a6f1ca276"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-04-14T23:16:29.460",
  "references": [
    {
      "url": "https://github.com/NuGet/NuGetGallery/commit/0e80f87628349207cdcaf55358491f8a6f1ca276",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. This enables writes to arbitrary blobs within the storage container, not limited to .nupkg files, resulting in potential tampering of existing content. This issue has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276."
    },
    {
      "lang": "es",
      "value": "NuGet Gallery es un repositorio de paquetes que impulsa nuget.org. Una vulnerabilidad de seguridad existe en el manejo de archivos .nuspec dentro de paquetes NuGet por parte del trabajo de backend de NuGetGallery. Un atacante puede suministrar un archivo nuspec manipulado con metadatos maliciosos, lo que lleva a la inyección de metadatos entre paquetes que puede resultar en ejecución remota de código (RCE) y/o escrituras arbitrarias de blobs debido a una validación de entrada insuficiente. El problema es explotable a través de la inyección de fragmentos URI utilizando identificadores de paquete no saneados, permitiendo a un atacante controlar la ruta de blob resuelta. Esto permite escrituras en blobs arbitrarios dentro del contenedor de almacenamiento, no limitado a archivos .nupkg, lo que resulta en una posible manipulación del contenido existente. Este problema ha sido parcheado en el commit 0e80f87628349207cdcaf55358491f8a6f1ca276."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "sourceIdentifier": "security-advisories@github.com"
}