CVE-2024-54138 XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing
Attackers can execute arbitrary scripts via unsanitized Markdown autolinks in NuGet Gallery, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-54138?
CVE-2024-54138 is a medium-severity cross-site scripting vulnerability in NuGetGallery, published on 6 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. This vulnerability is fixed in 2024.12.06.
Weakness: CWE-79
Which versions are affected by CVE-2024-54138?
It affects 1 product.
Products include Microsoft Nugetgallery.
How do I fix CVE-2024-54138?
No fix has been published for CVE-2024-54138 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-54138 being exploited?
There is no known exploitation of CVE-2024-54138 in the wild and no public exploit code.
Other vulnerabilities in NuGetGallery
Sources
Also known as GHSA-x448-p234-x5p8.