Chocolatey Azure Pipelines Agent Privilege Design Vulnerability

Chocolatey can handle various types of installation packages. Azure Pipelines Agent, also known as Azure Pipelines Agent, is primarily used in the Devops process to generate code or deploy software. a privilege design vulnerability in the Chocolatey Azure Pipelines Agent package v2.211.1 and prior versions, which stems from All users in the Authenticated users group have write access to the subfolder C:\Agent and all files in that folder, and an attacker could exploit the vulnerability to gain file write access.