CVE-2023-35390 .NET and Visual Studio Remote Code Execution Vulnerability

High 7.8 Published 8 Aug 2023 Updated 10 Aug 2026

Attackers can execute arbitrary code via command injection in Microsoft .NET and Visual Studio, requiring immediate patching.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-35390?

CVE-2023-35390 is a high-severity command injection vulnerability in Microsoft .Net, published on 8 Aug 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

.NET and Visual Studio Remote Code Execution Vulnerability

Weakness: CWE-77

Which versions are affected by CVE-2023-35390?

4 open source packages ship an affected version, including Microsoft.NET.Build.Containers, dotnet and dotnet-sdk. It affects 2 products.

Package	Affected	Fixed in
`Microsoft.NET.Build.Containers` NuGet	All versions	`7.0.307`
`Microsoft.NET.Build.Containers` NuGet	All versions	`7.0.307`
`dotnet` Bitnami	From `6.0.0`	`6.0.21, 7.0.10`
`dotnet-sdk` Bitnami	From `6.0.0`	`6.0.21, 7.0.10`

Products include Microsoft .Net, Microsoft Visual Studio 2022.

How do I fix CVE-2023-35390?

Upgrade Microsoft.NET.Build.Containers to 7.0.307 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-35390 being exploited?

There is no known exploitation of CVE-2023-35390 in the wild and no public exploit code.

All Microsoft .Net vulnerabilities

Sources

Also known as BIT-dotnet-2023-35390, BIT-dotnet-sdk-2023-35390, CLEANSTART-2025-YZ19947, GHSA-p8rx-fwgq-rh2f, UBUNTU-CVE-2023-35390.