NuGet Gallery powers nuget.org and handles .nuspec files in its backend jobs. A crafted .nuspec file with malicious metadata can cause cross‑package metadata injection, leading to remote code execution and arbitrary blob writes due to insufficient input validation. The attacker can control the resolved blob path and overwrite any blob in the storage container, potentially tampering existing content or injecting executable code.

The vendor is NuGet and the product is NuGetGallery. Every instance of NuGetGallery that has not been updated to include the patch in commit 0e80f87628349207cdcaf55358491f8a6f1ca276 is vulnerable. No specific product version range is supplied, so all unpatched deployments are at risk.

The CVSS score is 9.6, indicating a critical risk. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not yet been detected as an actively exploited flaw. Exploitation requires an attacker to supply a malicious .nuspec file and trigger the backend job, which can be done by uploading a package or invoking the job directly. Unsanitized package identifiers are interpreted as URI fragments, allowing the attacker to set arbitrary blob paths and perform writes to any object in the storage container. Successful exploitation can grant remote code execution and arbitrary data tampering.