ASPIRE.CLI · GHSA-hfpm-4fc4-g2wc · Package
NO FIX YET · SEE WHAT TO DO
The Aspire CLI creates a temporary file in a directory with insecure permissions. A local user with an account on the machine can use this to elevate their privileges.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Developers who run the Aspire CLI on a shared or multi-user machine where a local attacker could reach the temporary directory. The advisory was withdrawn as a duplicate, so the authoritative details and fix are in GHSA-m63f-xhvm-6mv5. Single-user development machines are less exposed.
Not affected if single-user-machine, version-outside-range
Who cares aspire, dotnet, local-machine, nuget
dotnet tool list --global or check the project's Aspire.Cli package version and compare it with the affected range 13.2.0 to below 13.6.5This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.
Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.