Executive brief
NuGet Gallery is the software that powers the nuget.org package repository, used by developers to share and download .NET code libraries. A vulnerability in how the system processes package metadata allows an attacker to overwrite arbitrary files in the storage system or potentially execute malicious code. This could lead to the tampering of legitimate software packages, posing a significant risk to the integrity of the software supply chain.
Technical details
A vulnerability in NuGetGallery's backend processing of .nuspec files allows for cross-package metadata injection. The root cause is insufficient input validation of package identifiers, which can be exploited via URI fragment injection to control resolved blob storage paths. An authenticated attacker with package upload privileges can craft a malicious .nuspec file to achieve arbitrary blob writes within the storage container or Remote Code Execution (RCE). This allows for the tampering of existing content beyond just .nupkg files. The issue has been addressed by hardening package metadata validation in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.
Affected products
- NuGet NuGetGallery < 0e80f87628349207cdcaf55358491f8a6f1ca276
Timeline
- 2026-04-14: disclosed
- 2026-04-14: patched: Fixed in commit 0e80f87628349207cdcaf55358491f8a6f1ca276
- 2026-04-14: advisory