{"id":"GHSA-g4vj-cjjj-v7hg","summary":"Defense in Depth update for NuGet Client","details":"### Impact\nThis update adds validation of the package ID and version during package download, in addition to the existing package signature validation.\n\n### Patches\n\n#### NuGet\n\nThe following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched:\n\n|Affected versions|Patched version|\n|--|--|\n|\u003e= 4.9.0, \u003c= 4.9.6|4.9.7|\n|\u003e= 5.11.0, \u003c= 5.11.6|5.11.7|\n|\u003e= 6.8.0, \u003c= 6.8.1|6.8.2|\n|\u003e= 6.11.0, \u003c= 6.11.1|6.11.2|\n|\u003e= 6.12.0, \u003c= 6.12.4|6.12.5|\n|\u003e= 6.14.0, \u003c= 6.14.2|6.14.3|\n|\u003e= 7.0.0, \u003c= 7.0.2|7.0.3|\n|7.3.0|7.3.1|\n\n#### .NET SDK\n\n* .NET 8.0.126 SDK\n* .NET 8.0.420 SDK\n* .NET 9.0.116 SDK\n* .NET 9.0.313 SDK\n* .NET 10.0.106 SDK\n* .NET 10.0.202 SDK\n\n### Workarounds\nN/A\n\n### References\nhttps://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr\n\n### Credit\n[splitline](https://x.com/_splitline_) with [DEVCORE](https://devco.re/)","modified":"2026-09-10T03:50:48.975042212Z","published":"2026-04-14T23:42:30Z","database_specific":{"cwe_ids":["CWE-345"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-04-14T23:42:30Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-g4vj-cjjj-v7hg"},{"type":"WEB","url":"https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr"},{"type":"PACKAGE","url":"https://github.com/NuGet/NuGet.Client"}],"affected":[{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.9.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json","last_known_affected_version_range":"\u003c= 5.11.6"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.8.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json","last_known_affected_version_range":"\u003c= 6.11.1"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.12.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.14.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 7.0.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Packaging","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Packaging"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 4.9.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"],"database_specific":{"last_known_affected_version_range":"\u003c= 5.11.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.8.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.11.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.12.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json","last_known_affected_version_range":"\u003c= 6.14.2"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json","last_known_affected_version_range":"\u003c= 7.0.2"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.0"},{"fixed":"4.9.7"}]}],"versions":["4.9.2","4.9.3","4.9.4","4.9.5","4.9.6"],"database_specific":{"last_known_affected_version_range":"\u003c= 4.9.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.11.7"}]}],"versions":["5.11.0","5.11.2","5.11.3","5.11.5","5.11.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json","last_known_affected_version_range":"\u003c= 5.11.6"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.8.0"},{"fixed":"6.8.2"}]}],"versions":["6.8.0","6.8.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.8.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.11.0"},{"fixed":"6.11.2"}]}],"versions":["6.11.0","6.11.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.11.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.12.0"},{"fixed":"6.12.5"}]}],"versions":["6.12.0","6.12.1","6.12.2","6.12.4"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.12.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.14.0"},{"fixed":"6.14.3"}]}],"versions":["6.14.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 6.14.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.3"}]}],"versions":["7.0.0","7.0.1"],"database_specific":{"last_known_affected_version_range":"\u003c= 7.0.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.3.0"},{"fixed":"7.3.1"}]}],"versions":["7.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-g4vj-cjjj-v7hg/GHSA-g4vj-cjjj-v7hg.json"}}],"schema_version":"1.9.0"}