Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 10.0.300, <= 10.0.303
Patched in 10.0.404
Vulnerable: >= 10.0.400, <= 10.0.403
Patched in 10.0.404
Vulnerable: >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148
Patched in 11.0.100
Details
Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.
A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:CWindows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.
The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.
Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 10.0.3xx | >= 10.0.300, <= 10.0.303 | 10.0.404 |
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 10.0.4xx | >= 10.0.400, <= 10.0.403 | 10.0.404 |
| Package | Affected version | Patched version |
|---|---|---|
| .NET SDK (dotnet-watch) 11.0.1xx | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100 |
| Package | Affected version | Patched version |
|---|---|---|
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.300, <= 10.0.303 | 10.0.404 |
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 10.0.400, <= 10.0.403 | 10.0.404 |
| Microsoft.DotNet.HotReload.Watch.Aspire | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100 |
This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.
Run dotnet --version from the directory where you run dotnet-watch to identify the selected SDK. Use dotnet --info and dotnet --list-sdks to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable global.json, including its version and rollForward settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See .NET SDK selection.
Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.
The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs installed through Visual Studio, update Visual Studio to a release that includes a fixed SDK. Updating only an application runtime does not replace SDK-bundled tools.
Ensure that global.json and its SDK roll-forward policy select a fixed SDK, then rerun dotnet --version in the working directory to verify the selection. The SDK-bundled watch tool is installed beneath that selected SDK's DotnetTools/dotnet-watch directory.
If Microsoft.DotNet.HotReload.Watch.Aspire is restored separately, update its package reference or the consuming tool's version configuration to 10.0.404 or 11.0.100, as applicable, restore the tool, and restart the consuming process. An SDK update alone does not update that restored copy.
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
V1.0 (November 10, 2026): Advisory published.
More nuget advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.