{"id":"GHSA-6r78-m64m-qwcf","summary":"Moq v4.20.0-rc to 4.20.1 share hashed user data","details":"Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.\n\nMoq v4.20.2 has removed this functionality.","modified":"2024-12-01T05:31:02.237947Z","published":"2023-08-10T19:25:23Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2023-08-10T19:25:23Z"},"references":[{"type":"WEB","url":"https://github.com/moq/moq/issues/1374"},{"type":"WEB","url":"https://github.com/moq/moq/pull/1363"},{"type":"WEB","url":"https://github.com/moq/moq/pull/1375"},{"type":"PACKAGE","url":"https://github.com/moq/moq"},{"type":"WEB","url":"https://www.cazzulino.com/sponsorlink.html"}],"affected":[{"package":{"name":"moq","ecosystem":"NuGet","purl":"pkg:nuget/moq"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0-rc"},{"fixed":"4.20.2"}]}],"versions":["4.20.0","4.20.0-rc","4.20.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-6r78-m64m-qwcf/GHSA-6r78-m64m-qwcf.json"}}],"schema_version":"1.9.0"}