GCVE - cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Microsoft (`67206627-3ef6-5870-9d98-26a9f2e7065c`)
Product	Nugetgallery (`5ed7271f-f788-51ad-9dbe-d13aa100cde6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/nuget/nugetgallery`	purl2cpe	2026-06-01 10:17:05.299539
`pkg:nuget/NuGetGallery.Core`	purl2cpe	2026-06-01 10:17:05.299541

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-54138`	vulnerable	2026-06-08 06:54:16.099113	XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. This vulnerability is fixed in 2024.12.06. Published: 2024-12-06T21:56:49.040Z Updated: 2024-12-10T14:38:58.829Z Open on db.gcve.eu Reference links https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-x448-p234-x5p8 https://github.com/NuGet/NuGetGallery/pull/10296	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-47604`	vulnerable	2026-06-08 06:48:12.928397	XSS vulnerability in NuGetGallery HTML attributes handling HIGH (8.2) NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which allows an attacker to execute arbitrary HTML or Javascript code in a victim's browser. Published: 2024-10-01T15:26:18.383Z Updated: 2024-10-01T17:13:16.824Z Open on db.gcve.eu Reference links https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-hq63-27r7-2j64 https://github.com/NuGet/NuGetGallery/pull/10193 https://github.com/NuGet/NuGetGallery/commit/3a18689dd0de856e03d081af999783f0e6e7ca70	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37304`	vulnerable	2026-06-08 06:39:47.088728	NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting MEDIUM (6.1) NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue. Published: 2024-06-12T14:27:40.184Z Updated: 2024-08-02T03:50:55.991Z Open on db.gcve.eu Reference links https://github.com/NuGet/NuGetGallery/security/advisories/GHSA-gwjh-c548-f787 https://github.com/NuGet/NuGetGallery/pull/9836 https://github.com/NuGet/NuGetGallery/commit/c52b023659f4ad7b626874c1063f2b5e878a4fe0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-1340`	vulnerable	2026-06-08 05:20:59.782307	Details available A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'. Published: 2020-06-09T19:44:12.000Z Updated: 2024-08-04T06:32:00.748Z Open on db.gcve.eu Reference links https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1340	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.