CVE-2026-39399 - Vulnerability Analysis

Overview

NuGet Gallery contains a stored XSS caused by insufficient input validation of crafted .nuspec file metadata in backend jobs, letting attackers perform remote code execution and arbitrary blob writes via URI fragment injection, exploit requires crafted package identifiers.

Severity & Score

Impact

Attackers can execute remote code and write arbitrary blobs, potentially leading to full system compromise and data tampering.

Mitigation

Apply the patch from commit 0e80f87628349207cdcaf55358491f8a6f1ca276 or update to the latest version.

References

• https://github.com/NuGet/NuGetGallery/commit/0e80f87628349207cdcaf55358491f8a6f1ca276
• https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner