NuGet Gallery RCE via crafted nuspec file (CVE-2026-39399)

Patch now - CVE-2026-39399 is a critical remote code execution (RCE) vulnerability in NuGet Gallery (all versions before commit 0e80f87) that grants an unauthenticated attacker arbitrary code execution on the server and the ability to overwrite any storage blob via crafted .nuspec metadata. Apply the patched commit immediately to prevent full server compromise.

Overview

A critical security vulnerability, CVE-2026-39399, has been identified in the NuGet Gallery, the backend software that powers the public nuget.org repository. The flaw resides in how the gallery’s backend job processes .nuspec files within uploaded NuGet packages. Due to insufficient input validation, an attacker can exploit this to achieve remote code execution (RCE) or write arbitrary data to the storage system.

Vulnerability Details

The vulnerability stems from improper handling of package metadata. An attacker can craft a malicious .nuspec file containing specially designed metadata. This allows for cross-package metadata injection. The core exploit path involves URI fragment injection using unsanitized package identifiers. This flaw gives an attacker control over the resolved blob path in the storage container, enabling writes to arbitrary blobs. This is not limited to package (.nupkg) files, meaning an attacker could potentially tamper with or overwrite existing content in the storage system, leading to a complete compromise of the NuGet Gallery instance.

Impact

With a CVSS score of 9.6 (Critical), this vulnerability poses a severe risk. Successful exploitation could allow an unauthenticated or low-privileged attacker to execute arbitrary code on the server hosting the NuGet Gallery. Additionally, the ability to perform arbitrary blob writes could lead to data corruption, defacement, or the planting of malicious files for further attacks. This vulnerability is not currently listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating it is not confirmed to be actively exploited in attacks at this time.

Remediation and Mitigation

The issue has been patched. Administrators of self-hosted NuGet Gallery instances must apply the fix immediately.

Primary Action: Patch Update your NuGet Gallery codebase to include the security fix from commit 0e80f87628349207cdcaf55358491f8a6f1ca276. This is the only complete remediation.

Mitigation Considerations If immediate patching is not possible, consider restricting network access to the gallery’s administrative backend interfaces as a temporary measure. However, patching is the definitive solution. Users of the public nuget.org service are protected, as Microsoft has applied the patch to its infrastructure.

Security Insight

This vulnerability highlights the persistent risk in software supply chain infrastructure, where a single component like a package metadata parser can become a high-impact attack vector. It echoes past incidents where insufficient validation in repository software led to server compromise, underscoring the need for rigorous security testing of all data processing paths in foundational development tools. The high CVSS score reflects the dangerous combination of low attack complexity and high-impact outcomes like RCE and data tampering.

Further Reading

• CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs