Microsoft TestPlatform CLI privilege escalation in artifact postprocessor

Severity: medium · CVSS 6.5 · Published 2026-11-11

Microsoft's VSTest command-line tool, used for running automated tests in .NET applications, contains a privilege escalation vulnerability in how it processes test artifacts. A local attacker with limited user privileges can forge test result files to execute arbitrary code with elevated permissions, potentially compromising the entire system or accessing sensitive data.

Vendors: Microsoft, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 11 November 2026.
Which products and versions are affected?
Microsoft .NET SDK 10.0 10.0.100 through 10.0.114, 10.0.400 through 10.0.403 (bundled VSTest); Microsoft .NET SDK 11.0 11.0.100-preview.1.26104.118 through 11.0.100-rc.3.26522.148 (bundled VSTest); Microsoft .NET SDK 8.0 8.0.100 through 8.0.133 (bundled VSTest); Microsoft .NET SDK 9.0 9.0.100 through 9.0.123, 9.0.300 through 9.0.320 (bundled VSTest); and 2 more.
Is there a fix for This vulnerability?
Yes. Microsoft.TestPlatform.CLI (NuGet): upgrade to 17.3.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked with local access, in a software library.
Am I affected?
Check whether you run Microsoft .NET SDK 10.0, Microsoft .NET SDK 11.0, Microsoft .NET SDK 8.0 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.TestPlatform.CLI (NuGet): upgrade to 17.3.4 or later
    dotnet add package Microsoft.TestPlatform.CLI --version 17.3.4

Technical details

The VSTest artifact postprocessor improperly validates forged executionComplete.json files created by other local users, allowing execution of attacker-controlled output handlers. This is a local privilege escalation (CWE-284) requiring low privileges and user interaction. An attacker gains arbitrary code execution in the security context of the test runner process.

Affected products

  • Microsoft TestPlatform CLI 17.2.0-preview-20220301-01 through 18.11.0
  • Microsoft .NET SDK 8.0 8.0.100 through 8.0.133 (bundled VSTest)
  • Microsoft .NET SDK 9.0 9.0.100 through 9.0.123, 9.0.300 through 9.0.320 (bundled VSTest)
  • Microsoft .NET SDK 10.0 10.0.100 through 10.0.114, 10.0.400 through 10.0.403 (bundled VSTest)
  • Microsoft .NET SDK 11.0 11.0.100-preview.1.26104.118 through 11.0.100-rc.3.26522.148 (bundled VSTest)

Timeline

  • 2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.