Critical RCE Flaw Hits NuGet Gallery Backend

The National Vulnerability Database (NVD) has issued an advisory for CVE-2026-39399, a critical vulnerability found in NuGet Gallery, the package repository powering nuget.org. This flaw resides within the backend job’s processing of .nuspec files inside NuGet packages. An attacker can craft a malicious .nuspec file, injecting nefarious metadata that could lead to cross-package metadata injection.

This injection isn’t just a nuisance; it’s a gateway to potential remote code execution (RCE) and/or arbitrary blob writes. The root cause? Insufficient input validation, pure and simple. The NVD highlights that the issue is exploitable via URI fragment injection, specifically by using unsanitized package identifiers. This allows an attacker to manipulate the resolved blob path, enabling writes to arbitrary blobs within the storage container—not just .nupkg files. The implications are severe, including potential tampering of existing content. A patch has been committed, identified by 0e80f87628349207cdcaf55358491f8a6f1ca276, so it’s time to get those updates in.