What is the CVSS score of CVE-2026-39399?

CVE-2026-39399 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of NuGet are affected by CVE-2026-39399?

CVE-2026-39399 affects NuGet Gallery and enables authenticated users to execute arbitrary code and modify storage content through malicious package metadata, creating a supply chain risk that could…

How to fix or mitigate CVE-2026-39399?

Within 24 hours: Identify all NuGet Gallery instances in your environment and confirm current deployment version; review recent package uploads for suspicious metadata patterns or storage modifications. Within 7 days: Apply vendor-released patch from commit 0e80f87628349207cdcaf55358491f8a6f1ca276 to all NuGet Gallery deployments; conduct post-patch validation testing. Within 30 days: Audit package storage for unauthorized modifications; review access logs for authenticated users with unusual activity; implement additional input validation controls on .nuspec file processing.

NuGet CVE-2026-39399

CRITICAL

Improper Input Validation (CWE-20)

2026-04-14 security-advisories@github.com

RCE

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:52 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 01:12 vuln.today

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. This enables writes to arbitrary blobs within the storage container, not limited to .nupkg files, resulting in potential tampering of existing content. This issue has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

AnalysisAI

Cross-package metadata injection in NuGet Gallery backend allows authenticated attackers to achieve remote code execution and arbitrary blob storage writes through crafted .nuspec files. Attackers exploit URI fragment injection via unsanitized package identifiers to control blob paths in the storage container, enabling tampering of existing content beyond .nupkg files. CVSS 9.6 (Critical) with network attack vector, low complexity, and scope change. Vendor-released patch available in commit 0e80f87628349207cdcaf55358491f8a6f1ca276. No public exploit identified at time of analysis.

Technical ContextAI

This vulnerability affects the NuGetGallery backend job responsible for processing NuGet package metadata from .nuspec XML manifest files. The root cause is CWE-20 (Improper Input Validation) in the handling of package identifiers within nuspec files. The backend job fails to sanitize URI fragments in package identifiers before using them to construct blob storage paths. NuGet Gallery uses Azure Blob Storage or similar object storage systems to host package files, and the vulnerable code allows attacker-controlled metadata to break out of intended path boundaries. The scope change (S:C in CVSS) indicates the vulnerability can affect resources beyond the vulnerable component's security scope, consistent with arbitrary blob writes across the storage container. The combination of metadata injection with storage path traversal creates conditions for both data integrity compromise and potential code execution if uploaded content is later processed or served by the gallery infrastructure.

Affected ProductsAI

NuGet Gallery backend job component prior to commit 0e80f87628349207cdcaf55358491f8a6f1ca276. This affects self-hosted NuGetGallery instances and the nuget.org public repository infrastructure. The vulnerability resides in the server-side package processing pipeline that handles .nuspec file parsing and blob storage operations during package upload and indexing workflows. Specific version ranges are not provided in the advisory, but all deployments prior to the patched commit are presumed vulnerable. The issue impacts the backend job subsystem specifically, which operates independently of the web frontend during asynchronous package processing. Vendor advisory available at https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr.

RemediationAI

Update NuGetGallery to a version incorporating commit 0e80f87628349207cdcaf55358491f8a6f1ca276 or later. Organizations running self-hosted NuGet Gallery instances should pull the latest code from the official repository and redeploy the backend job component immediately. Review the patch commit at https://github.com/NuGet/NuGetGallery/commit/0e80f87628349207cdcaf55358491f8a6f1ca276 to understand the implemented input validation and sanitization controls. After patching, audit existing blob storage for any anomalous files or modified packages uploaded during the vulnerability window, particularly examining blobs outside normal .nupkg naming conventions. For organizations unable to immediately patch, implement strict access controls limiting package upload privileges to thoroughly vetted accounts, enable detailed logging of all package uploads and blob storage operations, and consider disabling automated backend job processing until remediation is complete. Full advisory and remediation guidance at https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-9r3h-v4hx-rhfr.