ASPIRE.CLI · GHSA-fgfw-85w4-gx99 · Package
NO FIX YET · SEE WHAT TO DO
The .NET Aspire CLI writes sensitive information into a log file. An authorized local user can read that log and obtain the data.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Developers who run the .NET Aspire CLI on versions 13.2.0 up to 13.6.5 may have sensitive data written to local logs. Exposure requires local access to the machine or its log files by an authorized user. Teams not using the Aspire CLI in that range can skip it.
Not affected if version-outside-range
Who cares aspire, dotnet, nuget
Aspire.Cli version with dotnet tool list -g and compare it with the affected range 13.2.0 to below 13.6.5.Aspire.Cli 13.6.5 (the first version outside the affected range, per the product data; the advisory itself is withdrawn as a duplicate of GHSA-q6jf-24jf-m3cg).This advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.
Insertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.