CVE-2023-29337 — Vulnerability in NuGet.CommandLine — CVE Details

HIGH

NuGet Client Remote Code Execution Vulnerability

Published June 14, 2023Updated September 10, 2026Source: osv

Summary

### Description Microsoft is releasing this security advisory to provide information about a vulnerability in .NET and NuGet on Linux. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in .NET 6.0, .NET 7.0 and NuGet(nuget.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement) where a potential race condition that can lead to a symlink attack on Linux. Non-Linux platforms are not affected. ### Affected software This issue only affects Linux systems. #### NuGet & NuGet Packages - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.6.0 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.5.0 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.4.1 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.3.2 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.2.3 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 6.0.4 version or earlier. - Any NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, Microsoft.Build.NuGetSdkResolver, NuGet.PackageManagement 5.11.4 #### .NET SDK(s) - Any .NET SDK 7.0.106 or earlier, or 7.0.303 or earlier - Any .NET SDK 6.0.117 or earlier, or 6.0.312 or earlier, or 6.0.409 or earlier. ### Patches To fix the issue, please install the latest version of .NET 6.0 or .NET 7.0 and NuGet (NuGet.exe, NuGet.Protocol, NuGet.Common, NuGet.CommandLine, NuGet.Commands, NuGet.PackageManagement versions). If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. - If you're using NuGet.exe 6.6.0 or lower, you should download and install 6.6.1 from https://dist.nuget.org/win-x86-commandline/v6.6.1/nuget.exe. - If you're using NuGet.exe 6.5.0 or lower, you should download and install 6.5.1 from https://dist.nuget.org/win-x86-commandline/v6.5.1/nuget.exe. - If you're using NuGet.exe 6.4.1 or lower, you should download and install 6.4.2 from https://dist.nuget.org/win-x86-commandline/v6.4.2/nuget.exe. - If you're using NuGet.exe 6.3.2 or lower, you should download and install 6.3.3 from https://dist.nuget.org/win-x86-commandline/v6.3.3/nuget.exe. - If you're using NuGet.exe 6.2.3 or lower, you should download and install 6.2.4 from https://dist.nuget.org/win-x86-commandline/v6.2.4/nuget.exe. - If you're using NuGet.exe 6.0.4 or lower, you should download and install 6.0.5 from https://dist.nuget.org/win-x86-commandline/v6.0.5/nuget.exe. - If you're using NuGet.exe 5.11.4 or lower, you should download and install 5.11.5 from https://dist.nuget.org/win-x86-commandline/v5.11.5/nuget.exe. - If you're using .NET 7.0, you should download and install Runtime 7.0.7 or SDK 7.0.107 or SDK 7.0.304 from https://dotnet.microsoft.com/download/dotnet-core/7.0. - If you're using .NET 7.0, you should download and install Runtime 7.0.7 or SDK 7.0.107 or SDK 7.0.304 from https://dotnet.microsoft.com/download/dotnet-core/7.0. - If you're using .NET 6.0, you should download and install Runtime 6.0.18 or SDK 6.0.118 or SDK 6.0.312 from https://dotnet.microsoft.com/download/dotnet-core/6.0. ### Other details Announcement for this issue can be found at https://github.com/NuGet/Announcements/issues/69 MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29337

Advisory Timeline

First published June 14, 2023 (1216 days ago).
Last revised September 10, 2026 — 1183 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet

Update NuGet.CommandLine to 6.5.1 or later

dotnet add package NuGet.CommandLine --version 6.5.1

NuGet

Update NuGet.Commands to 6.2.4 or later

dotnet add package NuGet.Commands --version 6.2.4

NuGet

Update NuGet.CommandLine to 6.6.1 or later

dotnet add package NuGet.CommandLine --version 6.6.1

NuGet

Update NuGet.Commands to 6.4.2 or later

dotnet add package NuGet.Commands --version 6.4.2

NuGet

Update NuGet.Protocol to 6.3.3 or later

dotnet add package NuGet.Protocol --version 6.3.3

NuGet

Update NuGet.PackageManagement to 6.0.5 or later

dotnet add package NuGet.PackageManagement --version 6.0.5

NuGet

Update NuGet.PackageManagement to 6.3.3 or later

dotnet add package NuGet.PackageManagement --version 6.3.3

NuGet

Update NuGet.Common to 6.0.5 or later

dotnet add package NuGet.Common --version 6.0.5

NuGet

Update NuGet.PackageManagement to 5.11.5 or later

dotnet add package NuGet.PackageManagement --version 5.11.5

NuGet

Update NuGet.CommandLine to 6.4.2 or later

dotnet add package NuGet.CommandLine --version 6.4.2

NuGet

Update NuGet.Protocol to 6.0.5 or later

dotnet add package NuGet.Protocol --version 6.0.5

NuGet

Update NuGet.Commands to 6.5.1 or later

dotnet add package NuGet.Commands --version 6.5.1

NuGet

Update NuGet.CommandLine to 5.11.5 or later

dotnet add package NuGet.CommandLine --version 5.11.5

NuGet

Update NuGet.PackageManagement to 6.6.1 or later

dotnet add package NuGet.PackageManagement --version 6.6.1

NuGet

Update NuGet.Commands to 6.0.5 or later

dotnet add package NuGet.Commands --version 6.0.5

NuGet

Update NuGet.Commands to 5.11.5 or later

dotnet add package NuGet.Commands --version 5.11.5

NuGet

Update NuGet.Protocol to 5.11.5 or later

dotnet add package NuGet.Protocol --version 5.11.5

NuGet

Update NuGet.Protocol to 6.2.4 or later

dotnet add package NuGet.Protocol --version 6.2.4

NuGet

Update NuGet.Commands to 6.6.1 or later

dotnet add package NuGet.Commands --version 6.6.1

NuGet

Update NuGet.CommandLine to 6.0.5 or later

dotnet add package NuGet.CommandLine --version 6.0.5

NuGet

Update NuGet.Common to 6.3.3 or later

dotnet add package NuGet.Common --version 6.3.3

NuGet

Update NuGet.CommandLine to 6.2.4 or later

dotnet add package NuGet.CommandLine --version 6.2.4

NuGet

Update NuGet.Protocol to 6.4.2 or later

dotnet add package NuGet.Protocol --version 6.4.2

NuGet

Update NuGet.Common to 6.4.2 or later

dotnet add package NuGet.Common --version 6.4.2

NuGet

Update NuGet.CommandLine to 6.3.3 or later

dotnet add package NuGet.CommandLine --version 6.3.3

NuGet

Update NuGet.PackageManagement to 6.4.2 or later

dotnet add package NuGet.PackageManagement --version 6.4.2

NuGet

Update NuGet.Protocol to 6.5.1 or later

dotnet add package NuGet.Protocol --version 6.5.1

NuGet

Update NuGet.Common to 6.5.1 or later

dotnet add package NuGet.Common --version 6.5.1

NuGet

Update NuGet.Commands to 6.3.3 or later

dotnet add package NuGet.Commands --version 6.3.3

NuGet

Update NuGet.PackageManagement to 6.2.4 or later

dotnet add package NuGet.PackageManagement --version 6.2.4

NuGet

Update NuGet.Common to 5.11.5 or later

dotnet add package NuGet.Common --version 5.11.5

NuGet

Update NuGet.Protocol to 6.6.1 or later

dotnet add package NuGet.Protocol --version 6.6.1

NuGet

Update NuGet.Common to 6.2.4 or later

dotnet add package NuGet.Common --version 6.2.4

NuGet

Update NuGet.PackageManagement to 6.5.1 or later

dotnet add package NuGet.PackageManagement --version 6.5.1

NuGet

Update NuGet.Common to 6.6.1 or later

dotnet add package NuGet.Common --version 6.6.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (38)

Affects 1 ecosystem: nuget (6).

Package	Ecosystem	Affected	Fixed In
NuGet.CommandLine	nuget	6.5.0	6.5.1
NuGet.Commands	nuget	6.2.0, 6.2.1, 6.2.2	6.2.4
NuGet.CommandLine	nuget	6.6.0	6.6.1
NuGet.Commands	nuget	6.4.0	6.4.2
NuGet.Protocol	nuget	6.3.0, 6.3.1	6.3.3
NuGet.PackageManagement	nuget	6.0.0, 6.0.2	6.0.5
NuGet.PackageManagement	nuget	6.3.0, 6.3.1	6.3.3
NuGet.Common	nuget	6.0.0, 6.0.2	6.0.5
NuGet.PackageManagement	nuget	4.6.0, 4.6.1, 4.6.2, 4.6.3 (+12 more)	5.11.5
Microsoft.Build.NuGetSdkResolver	nuget	5.9.0-rc.7122	No fix available
NuGet.CommandLine	nuget	6.4.0	6.4.2
NuGet.Protocol	nuget	6.0.0, 6.0.2	6.0.5
NuGet.Commands	nuget	6.5.0	6.5.1
NuGet.CommandLine	nuget	4.6.2, 4.6.3, 4.6.4, 4.7.1 (+30 more)	5.11.5
NuGet.PackageManagement	nuget	6.6.0	6.6.1
NuGet.Commands	nuget	6.0.0, 6.0.2	6.0.5
NuGet.Commands	nuget	4.6.0, 4.6.1, 4.6.2, 4.6.3 (+12 more)	5.11.5
NuGet.Protocol	nuget	5.10.0, 5.11.0, 5.11.2, 5.11.3 (+6 more)	5.11.5
NuGet.Protocol	nuget	6.2.0, 6.2.1, 6.2.2	6.2.4
Microsoft.Build.NuGetSdkResolver	nuget	5.11.0-rc.10	No fix available
NuGet.Commands	nuget	6.6.0	6.6.1
NuGet.CommandLine	nuget	6.0.0, 6.0.2	6.0.5
NuGet.Common	nuget	6.3.0, 6.3.1	6.3.3
Microsoft.Build.NuGetSdkResolver	nuget	5.10.0-rc.7240	No fix available
NuGet.CommandLine	nuget	6.2.0, 6.2.1, 6.2.2	6.2.4
NuGet.Protocol	nuget	6.4.0	6.4.2
NuGet.Common	nuget	6.4.0	6.4.2
NuGet.CommandLine	nuget	6.3.0, 6.3.1	6.3.3
NuGet.PackageManagement	nuget	6.4.0	6.4.2
NuGet.Protocol	nuget	6.5.0	6.5.1
NuGet.Common	nuget	6.5.0	6.5.1
NuGet.Commands	nuget	6.3.0, 6.3.1	6.3.3
NuGet.PackageManagement	nuget	6.2.0, 6.2.1, 6.2.2	6.2.4
NuGet.Common	nuget	4.6.0, 4.6.1, 4.6.2, 4.6.3 (+12 more)	5.11.5
NuGet.Protocol	nuget	6.6.0	6.6.1
NuGet.Common	nuget	6.2.0, 6.2.1, 6.2.2	6.2.4
NuGet.PackageManagement	nuget	6.5.0	6.5.1
NuGet.Common	nuget	6.6.0	6.6.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-367
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-29337?: NuGet Client Remote Code Execution Vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.1/10).
How do I check if my project is affected by CVE-2023-29337?: CVE-2023-29337 affects NuGet.CommandLine, NuGet.Commands and NuGet.Protocol (and 3 more). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-29337 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.1

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-6qmf-mmc7-6c2p

Related CVEs

CVE-2024-0057
CRITICAL
NuGet Client Security Feature Bypass Vulnerability
CVE-2026-106112
HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
CVE-2022-41032
HIGH
NuGet Elevation of Privilege Vulnerability
CVE-2026-106115
HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies