CVE-2026-39399: NuGet Gallery: Improper Input Validation Enabling Arbitrary Blob Overwrite
CVE-2026-39399 affects NuGet Gallery, the software behind nuget.org, and is described as improper input validation in how the backend job handles .nuspec files, enabling metadata injection and arbitrary blob writes in storage. The record rates it critical with a CVSS v3.1 base score of 9.6 and states that it was patched in a specific commit. No confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-39399 is recorded against NuGet Gallery, the package repository that powers nuget.org. The record describes improper input validation (CWE-20) in how the NuGetGallery backend job processes .nuspec files inside NuGet packages. The upstream advisory is GHSA-9r3h-v4hx-rhfr and the fixing commit is 0e80f876.
Impact
According to the record, the flaw may lead to cross-package metadata injection, which may result in remote code execution and/or arbitrary blob writes. Writes are described as not limited to .nupkg files, so existing content in the storage container could be tampered with. The record assigns a CVSS v3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. Reading that vector, the integrity and availability impacts are high, confidentiality impact is none, and scope is changed; this is an interpretation of the vector, not a separate statement from the sources.
Affected products and versions
- NuGet NuGetGallery, listed in the record as versions less than commit 0e80f87628349207cdcaf55358491f8a6f1ca276.
- The record does not provide a released version number for the fix, and the fixes list is empty.
- Operators should compare their deployed build against the fixing commit history in the linked repository.
Exploitation status
The KEV catalog entry is not listed, and the SSVC exploitation value in the record is none. The EPSS probability is 0.00821 with percentile 0.5615. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Update NuGet Gallery deployments to a build that includes commit 0e80f87628349207cdcaf55358491f8a6f1ca276, following the GitHub advisory.
- Operators running their own instances should restrict write permissions of the backend job on the storage container to the minimum required.
- Until patched, review intake of packages from untrusted sources and limit who can publish packages to the instance.
Detection guidance
- Review ingestion logs for packages with unusually formed or unexpected nuspec metadata.
- Monitor the storage container for modifications to objects that are not .nupkg files, since the record says writes are not limited to that type.
- Alert on unexpected changes to existing blobs during package processing.
Limitations of the available information
The record is in Awaiting Analysis status and contains no CNA-independent scoring beyond the listed providers. It gives no technical details beyond the description, no released fixed version, and no evidence of exploitation. It does not confirm whether the hosted nuget.org service was affected or when the fix was deployed there. The EPSS date in the record is later than the publication date and should be verified against the source.
Frequently asked questions
What is CVE-2026-39399?
It is a critical improper input validation issue in NuGet Gallery, the software behind nuget.org, affecting how the backend job processes .nuspec files. The record links it to arbitrary blob writes and possible remote code execution.
Is this vulnerability known to be exploited?
No. It is not listed in the CISA KEV catalog, SSVC exploitation is recorded as none, and no confirmed exploitation appears in the sources consulted.
How should operators respond?
Update to a build that includes commit 0e80f87628349207cdcaf55358491f8a6f1ca276, restrict the backend job's write permissions on the storage container, and monitor for unexpected changes to stored objects.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.