CVE-2024-54138

CVE-2024-54138 describes an XSS vulnerability in NuGet Gallery’s Markdown autolinks handling. The issue stems from inadequate sanitization of autolinks (JavaScript in standard links is filtered, but autolinks aren’t), enabling potential cross-site scripting. The vulnerability has been fixed in ve...

CVE-2020-1340

NuGetGallery Spoofing Vulnerability (CVE-2020-1340) affects NuGetGallery. Root cause: improper sanitization of package metadata input, enabling spoofing of the UI. Exploitation could allow cross-site scripting by publishing crafted content via a gallery page (attack requires upload permissions). ...

CVE-2024-37304

CVE-2024-37304 concerns NuGetGallery, the NuGet.org frontend/back-end, where Markdown autolinks were not properly sanitized. The vulnerability allows XSS via autolinks such as , since autolinks can be rendered with insufficient sanitization despite standard JavaScript link filtering. A patch was ...