MICROSOFT.TESTPLATFORM.CLI · GHSA-6856-87hx-p5x7 · Package
FIX → 18.11.1 · 17.14.2 +7
The VSTest artifact postprocessor in Microsoft.TestPlatform.CLI trusts an executionComplete.json file that another local user can forge, and then runs attacker-controlled output handling. A local user on the same machine can therefore gain privileges.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Machines where Microsoft.TestPlatform.CLI or an affected .NET SDK runs tests, including Windows, Linux and macOS build agents and developer machines. The risk requires another local user on the same machine to plant a forged file, so single-user machines and ephemeral CI runners with one tenant are lower risk. Teams that run only on a current patched servicing line can skip it.
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
The VSTest artifact postprocessor can consume a forged executionComplete.json from another local user and execute attacker-controlled output handling.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/517
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:CThe tables list affected versions of Microsoft.TestPlatform.CLI and their patched versions. The VSTest CLI is also bundled in the .NET SDK; SDK versions are listed separately below. Updating a separately installed CLI package does not replace the SDK-bundled test runner.
Microsoft.TestPlatform.CLI is affected starting with 17.2.0-preview-20220301-01, including the first stable release, 17.2.0. Use a patched version listed below for a compatible servicing line.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Not affected if ephemeral-ci-runner, patched-servicing-line, single-user-machine
Who cares ci, dotnet, linux, macos, nuget, vstest, windows
dotnet --list-sdks to list installed SDKs and dotnet --version in the project directory to see which SDK is selected, including any global.json pin.Upgrade to 18.11.1 · 17.14.2 +7
17.3.4, 17.8.1, 17.11.2, 17.12.1, 17.14.2, 18.0.2, 18.7.1, 18.10.2 or 18.11.1.8.0.134; 8.0.4xx: 8.0.428; 9.0.1xx: 9.0.124; 9.0.3xx: 9.0.321; 10.0.1xx: 10.0.115; 10.0.4xx: 10.0.404; 11.0.1xx: 11.0.100.| Package | Affected version | Patched version |
|---|---|---|
| Microsoft.TestPlatform.CLI | >= 17.2.0-preview-20220301-01, < 17.3.0 | 17.3.4 |
| Microsoft.TestPlatform.CLI | = 17.3.0 | 17.3.4 |
| Microsoft.TestPlatform.CLI | = 17.3.1 | 17.3.4 |
| Microsoft.TestPlatform.CLI | = 17.3.2 | 17.3.4 |
| Microsoft.TestPlatform.CLI | = 17.3.3 | 17.3.4 |
| Microsoft.TestPlatform.CLI | = 17.8.0 | 17.8.1 |
| Microsoft.TestPlatform.CLI | = 17.11.0 | 17.11.2 |
| Microsoft.TestPlatform.CLI | = 17.11.1 | 17.11.2 |
| Microsoft.TestPlatform.CLI | = 17.12.0 | 17.12.1 |
| Microsoft.TestPlatform.CLI | = 17.14.0 | 17.14.2 |
| Microsoft.TestPlatform.CLI | = 17.14.1 | 17.14.2 |
| Microsoft.TestPlatform.CLI | = 18.0.0 | 18.0.2 |
| Microsoft.TestPlatform.CLI | = 18.0.1 | 18.0.2 |
| Microsoft.TestPlatform.CLI | = 18.7.0 | 18.7.1 |
| Microsoft.TestPlatform.CLI | = 18.10.0 | 18.10.2 |
| Microsoft.TestPlatform.CLI | = 18.10.1 | 18.10.2 |
| Microsoft.TestPlatform.CLI | = 18.11.0 | 18.11.1 |
Stable 18.10.1 remains affected; use Microsoft.TestPlatform.CLI 18.10.2 on that servicing line.
| Package | Affected version | Patched version |
|---|---|---|
| Microsoft.TestPlatform.CLI | = 17.4.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.4.1 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.5.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.6.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.6.1 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.6.2 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.6.3 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.7.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.7.1 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.7.2 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.9.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.10.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 17.13.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.3.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.4.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.5.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.5.1 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.6.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.8.0 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.8.1 | Use a compatible patched version listed above |
| Microsoft.TestPlatform.CLI | = 18.9.0 | Use a compatible patched version listed above |
These releases have no same-line fixed package in this update. Move to a compatible fixed servicing line listed above.
The following table applies to Microsoft.TestPlatform.CLI.
| Affected version | Patched version |
|---|---|
| = 17.3.0-preview-20220426-02 | Use a compatible patched version listed above |
| = 17.3.0-preview-20220530-08 | Use a compatible patched version listed above |
| = 17.3.0-preview-20220612-01 | Use a compatible patched version listed above |
| = 17.4.0-preview-20220707-01 | Use a compatible patched version listed above |
| = 17.4.0-preview-20220726-02 | Use a compatible patched version listed above |
| = 17.4.0-preview-20221003-03 | Use a compatible patched version listed above |
| = 17.4.0-release-20220926-01 | Use a compatible patched version listed above |
| = 17.5.0-preview-20221003-04 | Use a compatible patched version listed above |
| = 17.5.0-preview-20221221-03 | Use a compatible patched version listed above |
| = 17.6.0-preview-20230223-05 | Use a compatible patched version listed above |
| = 17.7.0-preview-23364-03 | Use a compatible patched version listed above |
| = 17.7.0-preview.23280.1 | Use a compatible patched version listed above |
| = 17.8.0-preview-23371-04 | Use a compatible patched version listed above |
| = 17.8.0-preview-23424-02 | Use a compatible patched version listed above |
| = 17.8.0-release-23468-02 | Use a compatible patched version listed above |
| = 17.9.0-preview-23503-02 | Use a compatible patched version liste |
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.