{"action":"Upgrade WixToolset.Sdk to 4.0.5 or later.","affected":[{"fixed":"4.0.5","introduced":"0"}],"component":"WixToolset.Sdk","cve_ids":["CVE-2024-29187"],"ecosystem":"NuGet","epss":0.00463,"exploited":false,"fixed_versions":["4.0.5"],"ghsa_id":"GHSA-rf39-3f98-xr7r","id":"tcs_01M5N8ZZY32680CG2SM25HR3GP","modified_at":"2026-09-10T03:50:11.017919006Z","published_at":"2024-03-25T19:42:32Z","references":["https://osv.dev/vulnerability/GHSA-rf39-3f98-xr7r","https://github.com/wixtoolset/issues/security/advisories/GHSA-rf39-3f98-xr7r","https://nvd.nist.gov/vuln/detail/CVE-2024-29187","https://github.com/wixtoolset/wix/commit/75a8c75d4e02ea219008dc5af7d03869291d61f7","https://github.com/wixtoolset/wix3/commit/6d372e5169f1a334a395cdf496443bc0732098e9","https://github.com/wixtoolset/issues"],"severity":{"label":"high","score":7.3},"sources":[{"source":"osv","source_id":"GHSA-rf39-3f98-xr7r#NuGet/WixToolset.Sdk","url":"https://osv.dev/vulnerability/GHSA-rf39-3f98-xr7r"}],"summary":"WiX based installers are vulnerable to binary hijack when run as SYSTEM"}