{"id":"GHSA-hfpm-4fc4-g2wc","summary":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","details":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.\n\n## Original Description\nCreation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","modified":"2026-11-10T22:30:03.447265936Z","published":"2026-11-10T21:33:43Z","withdrawn":"2026-11-10T22:17:41Z","database_specific":{"github_reviewed_at":"2026-11-10T22:17:41Z","nvd_published_at":"2026-11-10T19:20:26Z","cwe_ids":["CWE-379"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120778"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778"}],"affected":[{"package":{"name":"Aspire.Cli","ecosystem":"NuGet","purl":"pkg:nuget/Aspire.Cli"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.2.0"}]}],"versions":["13.2.0","13.2.1","13.2.2","13.2.3","13.2.4","13.3.0","13.3.1","13.3.2","13.3.3","13.3.4","13.3.5","13.4.0","13.4.1","13.4.2","13.4.3","13.4.4","13.4.5","13.4.6","13.5.0","13.5.1","13.5.2","13.5.3","13.5.4","13.6.0","13.6.1","13.6.2","13.6.3","13.6.4","13.6.5"],"database_specific":{"last_known_affected_version_range":"\u003c 13.6.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-hfpm-4fc4-g2wc/GHSA-hfpm-4fc4-g2wc.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}