CVE-2025-26646
1 advisory.
NuGet/Microsoft.Build.Tasks.Core CVE-2025-26646: high 8
Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability
Action: Upgrade Microsoft.Build.Tasks.Core to 15.9.30 (15.9.x), 16.11.6 (16.11.x), 17.8.29 (17.8.x), 17.10.29 (17.10.x), 17.12.36 (17.12.x), 17.13.26 (17.13.x) or 17.14.8 (17.14.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 15.8.166 | 15.9.30 | - |
| 16.0.461 | 16.11.6 | - |
| 17.0.0 | 17.8.29 | - |
| 17.9.5 | 17.10.29 | - |
| 17.11.4 | 17.12.36 | - |
| 17.12.6 | 17.13.26 | - |
| 17.13.9 | 17.14.8 | - |
Fixed versions
| 15.9.30 | 16.11.6 | 17.8.29 | 17.10.29 | 17.12.36 | 17.13.26 | 17.14.8 |
Sources
- osv: GHSA-h4j7-5rxr-p4wc
- https://github.com/dotnet/msbuild/security/advisories/GHSA-h4j7-5rxr-p4wc
- https://nvd.nist.gov/vuln/detail/CVE-2025-26646
- https://github.com/dotnet/announcements/issues/356
- https://github.com/dotnet/msbuild/issues/11846
- https://github.com/dotnet/msbuild
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646
CVE-2025-26646 · published · modified · JSON