{"action":"Upgrade Microsoft.Build.Tasks.Core to 15.9.30 (15.9.x), 16.11.6 (16.11.x), 17.8.29 (17.8.x), 17.10.29 (17.10.x), 17.12.36 (17.12.x), 17.13.26 (17.13.x) or 17.14.8 (17.14.x) or later.","affected":[{"fixed":"15.9.30","introduced":"15.8.166"},{"fixed":"16.11.6","introduced":"16.0.461"},{"fixed":"17.8.29","introduced":"17.0.0"},{"fixed":"17.10.29","introduced":"17.9.5"},{"fixed":"17.12.36","introduced":"17.11.4"},{"fixed":"17.13.26","introduced":"17.12.6"},{"fixed":"17.14.8","introduced":"17.13.9"}],"component":"Microsoft.Build.Tasks.Core","cve_ids":["CVE-2025-26646"],"ecosystem":"NuGet","epss":0.01266,"exploited":false,"fixed_versions":["15.9.30","16.11.6","17.8.29","17.10.29","17.12.36","17.13.26","17.14.8"],"ghsa_id":"GHSA-h4j7-5rxr-p4wc","id":"tcs_01M5N8Q7CSMNXXT8WY42PXQSS3","modified_at":"2026-09-10T03:50:58.334015588Z","published_at":"2025-05-13T21:38:50Z","references":["https://osv.dev/vulnerability/GHSA-h4j7-5rxr-p4wc","https://github.com/dotnet/msbuild/security/advisories/GHSA-h4j7-5rxr-p4wc","https://nvd.nist.gov/vuln/detail/CVE-2025-26646","https://github.com/dotnet/announcements/issues/356","https://github.com/dotnet/msbuild/issues/11846","https://github.com/dotnet/msbuild","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-h4j7-5rxr-p4wc","url":"https://osv.dev/vulnerability/GHSA-h4j7-5rxr-p4wc"}],"summary":"Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability"}