CVE-2020-1340

NuGetGallery Spoofing Vulnerability (CVE-2020-1340) affects NuGetGallery. Root cause: improper sanitization of package metadata input, enabling spoofing of the UI. Exploitation could allow cross-site scripting by publishing crafted content via a gallery page (attack requires upload permissions). ...

CVE-2024-47604

CVE-2024-47604 describes an XSS vulnerability in NuGetGallery’s handling of HTML element attributes. The issue could allow an attacker to execute arbitrary HTML or JavaScript in a victim’s browser. Affected product is NuGet Gallery (NuGet.org backend/frontend). The underlying root cause is improp...

CVE-2024-54138

CVE-2024-54138 describes an XSS vulnerability in NuGet Gallery’s Markdown autolinks handling. The issue stems from inadequate sanitization of autolinks (JavaScript in standard links is filtered, but autolinks aren’t), enabling potential cross-site scripting. The vulnerability has been fixed in ve...

CVE-2024-37304

CVE-2024-37304 concerns NuGetGallery, the NuGet.org frontend/back-end, where Markdown autolinks were not properly sanitized. The vulnerability allows XSS via autolinks such as , since autolinks can be rendered with insufficient sanitization despite standard JavaScript link filtering. A patch was ...