{"id":"GHSA-fgfw-85w4-gx99","kind":"vulnerability","aliases":["GHSA-fgfw-85w4-gx99"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120792 - Aspire Information Disclosure Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q6jf-24jf-m3cg. This link is maintained to preserve external references.\n\n## Original Description\nInsertion of sensitive information into log file in .NET Aspire allows an authorized attacker to disclose information locally.","summary":"The .NET Aspire CLI writes sensitive information into a log file. An authorized local user can read that log and obtain the data.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aspire.Cli","fixed":[],"affected":">= 13.2.0, < 13.6.5","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["aspire","cwe-532","dotnet","nuget","package"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed `Aspire.Cli` version with `dotnet tool list -g` and compare it with the affected range 13.2.0 to below 13.6.5.\n- Review Aspire CLI log files on machines where the tool runs for credentials or tokens (location unknown from sources).","fix":"- `Aspire.Cli` `13.6.5` (the first version outside the affected range, per the product data; the advisory itself is withdrawn as a duplicate of GHSA-q6jf-24jf-m3cg).","status":"withdrawn","published_at":"2026-11-10T21:33:44+00:00","first_seen_at":"2026-11-10T22:32:48+00:00","triaged_at":"2026-11-10T22:34:42+00:00","updated_at":"2026-11-10T22:34:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T22:34:42Z","model":"claude-haiku-5-5","output":{"fix":"- `Aspire.Cli` `13.6.5` (the first version outside the affected range, per the product data; the advisory itself is withdrawn as a duplicate of GHSA-q6jf-24jf-m3cg).","reach":"local","title":"Aspire CLI: sensitive data written to log files, local disclosure","impact":"low","summary":"The .NET Aspire CLI writes sensitive information into a log file. An authorized local user can read that log and obtain the data.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","aspire","nuget"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Sensitive information in logs is readable by a local user","analyst_note":"","how_to_check":"- Check the installed `Aspire.Cli` version with `dotnet tool list -g` and compare it with the affected range 13.2.0 to below 13.6.5.\n- Review Aspire CLI log files on machines where the tool runs for credentials or tokens (location unknown from sources).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range"],"who_is_affected":"Developers who run the .NET Aspire CLI on versions 13.2.0 up to 13.6.5 may have sensitive data written to local logs. Exposure requires local access to the machine or its log files by an authorized user. Teams not using the Aspire CLI in that range can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4631,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120792':8A '-2026':7A '-532':26B '24jf':69C '85w4':16A,21A 'advisori':2A,5A,54C,56C 'allow':91C 'aspir':9A,24B,32B,90C 'aspire.cli':23A 'attack':94C 'author':42B,93C 'cli':33B 'cve':6A 'cwe':25B 'data':52B 'descript':80C 'disclos':96C 'disclosur':11A 'dotnet':27B 'duplic':1A,53C,64C 'extern':77C 'fgfw':15A,20A 'file':40B,87C 'ghsa':14A,19A,67C 'ghsa-fgfw-85w4-gx99':13A,18A 'ghsa-q6jf-24jf-m3cg':66C 'gx99':17A,22A 'inform':10A,36B,84C,97C 'insert':81C 'link':72C 'local':43B,98C 'log':39B,48B,86C 'm3cg':70C 'maintain':74C 'microsoft':3A 'net':31B,89C 'nuget':28B 'obtain':50B 'origin':79C 'packag':29B 'preserv':76C 'q6jf':68C 'read':46B 'refer':78C 'secur':4A 'sensit':35B,83C 'user':44B 'vulner':12A 'withdrawn':59C 'write':34B","nicknames":[],"mitigations":[],"who_affected":"Developers who run the .NET Aspire CLI on versions 13.2.0 up to 13.6.5 may have sensitive data written to local logs. Exposure requires local access to the machine or its log files by an authorized user. Teams not using the Aspire CLI in that range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aspirecli"],"ptokens":["aspire","cli"],"labels":["aspire","cwe532","dotnet","high","nuget","package"],"campaign_type":null,"search_a":"'-120792':8A '-2026':7A '85w4':16A,21A 'advisori':2A,5A 'aspir':9A 'aspire.cli':23A 'cve':6A 'disclosur':11A 'duplic':1A 'fgfw':15A,20A 'ghsa':14A,19A 'ghsa-fgfw-85w4-gx99':13A,18A 'gx99':17A,22A 'inform':10A 'microsoft':3A 'secur':4A 'vulner':12A","search_b":"'-532':26B 'aspir':24B,32B 'author':42B 'cli':33B 'cwe':25B 'data':52B 'dotnet':27B 'file':40B 'inform':36B 'local':43B 'log':39B,48B 'net':31B 'nuget':28B 'obtain':50B 'packag':29B 'read':46B 'sensit':35B 'user':44B 'write':34B","search_c":"'24jf':69C 'advisori':54C,56C 'allow':91C 'aspir':90C 'attack':94C 'author':93C 'descript':80C 'disclos':96C 'duplic':53C,64C 'extern':77C 'file':87C 'ghsa':67C 'ghsa-q6jf-24jf-m3cg':66C 'inform':84C,97C 'insert':81C 'link':72C 'local':98C 'log':86C 'm3cg':70C 'maintain':74C 'net':89C 'origin':79C 'preserv':76C 'q6jf':68C 'refer':78C 'sensit':83C 'withdrawn':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:33:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-fgfw-85w4-gx99","url":"https://github.com/advisories/GHSA-fgfw-85w4-gx99","severity":"high","published_at":"2026-11-10T21:33:44+00:00","modified_at":"2026-11-10T22:30:51+00:00","first_seen_at":"2026-11-10T22:32:48+00:00","fetched_at":"2026-11-10T22:48:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}