{"id":"GHSA-6qmf-mmc7-6c2p","summary":"NuGet Client Remote Code Execution Vulnerability","details":"### Description\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET and NuGet on Linux. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.\n\nA vulnerability exists in .NET 6.0, .NET 7.0 and NuGet(nuget.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement) where a potential race condition that can lead to a symlink attack on Linux. Non-Linux platforms are not affected.\n\n### Affected software\nThis issue only affects Linux systems.\n\n#### NuGet & NuGet Packages\n\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.6.0 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.5.0 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.4.1 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.3.2 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.2.3 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.0.4 version or earlier.\n- Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 5.11.4\n\n#### .NET SDK(s)\n\n- Any .NET SDK 7.0.106 or earlier, or 7.0.303 or earlier\n- Any .NET SDK 6.0.117 or earlier, or 6.0.312 or earlier, or 6.0.409 or earlier.\n\n\n### Patches\nTo fix the issue, please install the latest version of .NET 6.0 or .NET 7.0 and NuGet (NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, NuGet.PackageManagement  versions). If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.\n\n- If you're using NuGet.exe 6.6.0 or lower, you should download and install 6.6.1 from https://dist.nuget.org/win-x86-commandline/v6.6.1/nuget.exe.\n- If you're using NuGet.exe 6.5.0 or lower, you should download and install 6.5.1 from https://dist.nuget.org/win-x86-commandline/v6.5.1/nuget.exe.\n- If you're using NuGet.exe 6.4.1 or lower, you should download and install 6.4.2 from https://dist.nuget.org/win-x86-commandline/v6.4.2/nuget.exe.\n- If you're using NuGet.exe 6.3.2 or lower, you should download and install 6.3.3 from https://dist.nuget.org/win-x86-commandline/v6.3.3/nuget.exe.\n- If you're using NuGet.exe 6.2.3 or lower, you should download and install 6.2.4 from https://dist.nuget.org/win-x86-commandline/v6.2.4/nuget.exe.\n- If you're using NuGet.exe 6.0.4 or lower, you should download and install 6.0.5 from https://dist.nuget.org/win-x86-commandline/v6.0.5/nuget.exe.\n- If you're using NuGet.exe 5.11.4 or lower, you should download and install 5.11.5 from https://dist.nuget.org/win-x86-commandline/v5.11.5/nuget.exe.\n- If you're using .NET 7.0, you should download and install Runtime 7.0.7 or SDK 7.0.107 or SDK 7.0.304 from https://dotnet.microsoft.com/download/dotnet-core/7.0.\n\n- If you're using .NET 7.0, you should download and install Runtime 7.0.7 or SDK 7.0.107 or SDK 7.0.304 from https://dotnet.microsoft.com/download/dotnet-core/7.0.\n- If you're using .NET 6.0, you should download and install Runtime 6.0.18 or SDK 6.0.118 or SDK 6.0.312 from https://dotnet.microsoft.com/download/dotnet-core/6.0.\n\n\n### Other details\nAnnouncement for this issue can be found at https://github.com/NuGet/Announcements/issues/69\n\nMSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337\n","aliases":["CVE-2023-29337"],"modified":"2026-08-24T00:34:31.601759094Z","published":"2023-06-14T16:44:21Z","database_specific":{"nvd_published_at":"2023-06-14T15:15:09Z","cwe_ids":["CWE-367"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-06-14T16:44:21Z"},"references":[{"type":"WEB","url":"https://github.com/NuGet/NuGet.Client/security/advisories/GHSA-6qmf-mmc7-6c2p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29337"},{"type":"WEB","url":"https://github.com/NuGet/NuGet.Client/commit/7fe6b814c901490292f02d8ea12749505fbb959a"},{"type":"PACKAGE","url":"https://github.com/NuGet/NuGet.Client"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337"}],"affected":[{"package":{"name":"Microsoft.Build.NuGetSdkResolver","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Build.NuGetSdkResolver"},"versions":["5.9.0-rc.7122"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}],"versions":["6.2.0","6.2.1","6.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"versions":["6.3.0","6.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"versions":["6.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.1"}]}],"versions":["6.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}],"versions":["6.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"Microsoft.Build.NuGetSdkResolver","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Build.NuGetSdkResolver"},"versions":["5.10.0-rc.7240"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"Microsoft.Build.NuGetSdkResolver","ecosystem":"NuGet","purl":"pkg:nuget/Microsoft.Build.NuGetSdkResolver"},"versions":["5.11.0-rc.10"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}],"versions":["6.2.0","6.2.1","6.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"versions":["6.3.0","6.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"versions":["6.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.1"}]}],"versions":["6.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}],"versions":["6.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}],"versions":["6.2.0","6.2.1","6.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"versions":["6.3.0","6.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"versions":["6.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.1"}]}],"versions":["6.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}],"versions":["6.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}],"versions":["6.2.0","6.2.1","6.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"versions":["6.3.0","6.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"versions":["6.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.1"}]}],"versions":["6.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}],"versions":["6.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.5"}]}],"versions":["6.0.0","6.0.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.4"}]}],"versions":["6.2.0","6.2.1","6.2.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.0"},{"fixed":"6.3.3"}]}],"versions":["6.3.0","6.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.0"},{"fixed":"6.4.2"}]}],"versions":["6.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.5.1"}]}],"versions":["6.5.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.6.0"},{"fixed":"6.6.1"}]}],"versions":["6.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.PackageManagement","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.PackageManagement"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"5.11.5"}]}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.7.0-preview1-4986","5.10.0","5.11.0","5.11.2","5.11.3","5.7.1","5.7.2","5.9.0","5.9.1","5.9.2","5.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Commands","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Commands"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"5.11.5"}]}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.7.0-preview1-4986","5.10.0","5.11.0","5.11.2","5.11.3","5.7.1","5.7.2","5.9.0","5.9.1","5.9.2","5.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.CommandLine","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.CommandLine"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"5.11.5"}]}],"versions":["4.6.2","4.6.3","4.6.4","4.7.1","4.7.2","4.7.3","4.8.2","4.9.2","4.9.3","4.9.4","4.9.5","4.9.6","4.9.7","5.0.2","5.1.0","5.10.0","5.11.0","5.11.2","5.11.3","5.2.0","5.2.1","5.3.0","5.3.1","5.4.0","5.5.1","5.6.0","5.7.0","5.7.1","5.7.2","5.8.0","5.8.1","5.9.1","5.9.2","5.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Common","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"5.11.5"}]}],"versions":["4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.7.0-preview1-4986","5.10.0","5.11.0","5.11.2","5.11.3","5.7.1","5.7.2","5.9.0","5.9.1","5.9.2","5.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}},{"package":{"name":"NuGet.Protocol","ecosystem":"NuGet","purl":"pkg:nuget/NuGet.Protocol"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"5.11.5"}]}],"versions":["5.10.0","5.11.0","5.11.2","5.11.3","5.7.1","5.7.2","5.9.0","5.9.1","5.9.2","5.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-6qmf-mmc7-6c2p/GHSA-6qmf-mmc7-6c2p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}