{"id":"GHSA-hfpm-4fc4-g2wc","kind":"vulnerability","aliases":["GHSA-hfpm-4fc4-g2wc"],"related":[],"title":"Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.\n\n## Original Description\nCreation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.","summary":"The Aspire CLI creates a temporary file in a directory with insecure permissions. A local user with an account on the machine can use this to elevate their privileges.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Aspire.Cli","fixed":[],"affected":">= 13.2.0, < 13.6.5","ecosystem":"nuget"}],"ecosystems":["nuget"],"tags":["aspire","cwe-379","dotnet","local-machine","nuget","package"],"not_affected_if":["single-user-machine","version-outside-range"],"how_to_check":"- Run `dotnet tool list --global` or check the project's `Aspire.Cli` package version and compare it with the affected range 13.2.0 to below 13.6.5\n- Check whether the advisory GHSA-m63f-xhvm-6mv5 applies, since this entry is a withdrawn duplicate of it","fix":"- Aspire.Cli: the sources do not state a fixed version for this entry; see GHSA-m63f-xhvm-6mv5","status":"withdrawn","published_at":"2026-11-10T21:33:43+00:00","first_seen_at":"2026-11-10T22:22:33+00:00","triaged_at":"2026-11-10T22:24:19+00:00","updated_at":"2026-11-10T22:24:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T22:24:19Z","model":"claude-haiku-5-5","output":{"fix":"- Aspire.Cli: the sources do not state a fixed version for this entry; see GHSA-m63f-xhvm-6mv5","reach":"local","title":"Aspire CLI: insecure temp file permissions let local users gain privileges","impact":"high","summary":"The Aspire CLI creates a temporary file in a directory with insecure permissions. A local user with an account on the machine can use this to elevate their privileges.","audience":"developers","category":"package","nicknames":[],"who_cares":["aspire","dotnet","nuget","local-machine"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the machine","analyst_note":"Advisory is withdrawn as a duplicate; confirm the fixed version and details from GHSA-m63f-xhvm-6mv5.","how_to_check":"- Run `dotnet tool list --global` or check the project's `Aspire.Cli` package version and compare it with the affected range 13.2.0 to below 13.6.5\n- Check whether the advisory GHSA-m63f-xhvm-6mv5 applies, since this entry is a withdrawn duplicate of it","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-machine","version-outside-range"],"who_is_affected":"Developers who run the Aspire CLI on a shared or multi-user machine where a local attacker could reach the temporary directory. The advisory was withdrawn as a duplicate, so the authoritative details and fix are in GHSA-m63f-xhvm-6mv5. Single-user development machines are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4646,"output_tokens":598,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120778':8A '-2026':7A '-379':27B '4fc4':17A,22A '6mv5':80C 'account':52B 'advisori':2A,5A,64C,66C 'allow':103C 'aspir':9A,25B,35B,102C 'aspire.cli':24A 'attack':106C 'author':105C 'cli':36B 'creat':37B 'creation':91C 'cve':6A 'cwe':26B 'descript':90C 'directori':43B,96C 'dotnet':28B 'duplic':1A,63C,74C 'elev':10A,60B,108C 'extern':87C 'file':40B,94C 'g2wc':18A,23A 'ghsa':15A,20A,77C 'ghsa-hfpm-4fc4-g2wc':14A,19A 'ghsa-m63f-xhvm-6mv5':76C 'hfpm':16A,21A 'insecur':45B,98C 'link':82C 'local':30B,48B,110C 'local-machin':29B 'm63f':78C 'machin':31B,55B 'maintain':84C 'microsoft':3A 'net':101C 'nuget':32B 'origin':89C 'packag':33B 'permiss':46B,99C 'preserv':86C 'privileg':12A,62B,109C 'refer':88C 'secur':4A 'temporari':39B,93C 'use':57B 'user':49B 'vulner':13A 'withdrawn':69C 'xhvm':79C","nicknames":[],"mitigations":[],"who_affected":"Developers who run the Aspire CLI on a shared or multi-user machine where a local attacker could reach the temporary directory. The advisory was withdrawn as a duplicate, so the authoritative details and fix are in GHSA-m63f-xhvm-6mv5. Single-user development machines are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":["aspirecli"],"ptokens":["aspire","cli"],"labels":["aspire","cwe379","dotnet","high","localmachine","nuget","package"],"campaign_type":null,"search_a":"'-120778':8A '-2026':7A '4fc4':17A,22A 'advisori':2A,5A 'aspir':9A 'aspire.cli':24A 'cve':6A 'duplic':1A 'elev':10A 'g2wc':18A,23A 'ghsa':15A,20A 'ghsa-hfpm-4fc4-g2wc':14A,19A 'hfpm':16A,21A 'microsoft':3A 'privileg':12A 'secur':4A 'vulner':13A","search_b":"'-379':27B 'account':52B 'aspir':25B,35B 'cli':36B 'creat':37B 'cwe':26B 'directori':43B 'dotnet':28B 'elev':60B 'file':40B 'insecur':45B 'local':30B,48B 'local-machin':29B 'machin':31B,55B 'nuget':32B 'packag':33B 'permiss':46B 'privileg':62B 'temporari':39B 'use':57B 'user':49B","search_c":"'6mv5':80C 'advisori':64C,66C 'allow':103C 'aspir':102C 'attack':106C 'author':105C 'creation':91C 'descript':90C 'directori':96C 'duplic':63C,74C 'elev':108C 'extern':87C 'file':94C 'ghsa':77C 'ghsa-m63f-xhvm-6mv5':76C 'insecur':98C 'link':82C 'local':110C 'm63f':78C 'maintain':84C 'net':101C 'origin':89C 'permiss':99C 'preserv':86C 'privileg':109C 'refer':88C 'temporari':93C 'withdrawn':69C 'xhvm':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:33:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hfpm-4fc4-g2wc","url":"https://github.com/advisories/GHSA-hfpm-4fc4-g2wc","severity":"high","published_at":"2026-11-10T21:33:43+00:00","modified_at":"2026-11-10T22:17:42+00:00","first_seen_at":"2026-11-10T22:22:33+00:00","fetched_at":"2026-11-10T22:32:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}