GHSA-hfpm-4fc4-g2wc: Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

Published Nov 10, 2026

Updated

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-m63f-xhvm-6mv5. This link is maintained to preserve external references.

Original Description Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.

Affected Software

2 affected components

nuget/aspire.cli>=13.2.0<13.6.5

nuget/aspire.cli>=13.2.0

Event History

Nov 10, 2026

Advisory Published

via GitHub·09:33 PM

Data Sourced

via GitHub·09:33 PM

DescriptionSeverityWeaknessAffected Software

Withdrawn

via GitHub·10:17 PM

Frequently Asked Questions

Should this advisory be tracked as a separate finding?

No. It has been withdrawn as a duplicate of GHSA-m63f-xhvm-6mv5, and the record is retained only to preserve external references.

What level of access does an attacker need?

Exploitation requires an authorized attacker with local access. The supplied vector also indicates that user interaction is required.

Which component is identified as affected?

The listed software is nuget/aspire.cli.

GHSA-hfpm-4fc4-g2wc: Duplicate Advisory: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability

Affected Software

Event History

Frequently Asked Questions

Should this advisory be tracked as a separate finding?

What level of access does an attacker need?

Which component is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Should this advisory be tracked as a separate finding?

What level of access does an attacker need?

Which component is identified as affected?