- Severity: HIGH
- CVE: CVE-2026-120792
- Ecosystems: nuget, nuget, nuget, nuget, nuget, nuget, npm, npm, npm, npm, npm, npm
- Packages: Aspire.Cli, Aspire.Cli.linux-x64, Aspire.Cli.linux-arm64, Aspire.Cli.linux-musl-x64, Aspire.Cli.osx-x64, Aspire.Cli.osx-arm64, @microsoft/aspire-cli, @microsoft/aspire-cli-linux-x64, @microsoft/aspire-cli-linux-arm64, @microsoft/aspire-cli-linux-musl-x64, @microsoft/aspire-cli-osx-x64, @microsoft/aspire-cli-osx-arm64
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.
Insecure temporary files used by Aspire CLI can allow a local attacker to obtain sensitive configuration information.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/518
## CVSS Details
– **Version:** 3.1
– **Severity:** High
– **Score:** 7.3
– **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L`
– **Weakness:** CWE-532 (Insertion of Sensitive Information into Log File)
– **MSRC severity:** Important
– **Impact:** Information Disclosure
## Affected Platforms
– **Platforms:** Linux, macOS
– **Architectures:** x64, Arm64
## Affected Packages
### Standalone Aspire CLI
Package | Affected version | Patched version
— | — | —
Aspire CLI ([Aspire.Cli](https://www.nuget.org/packages/Aspire.Cli)) | >= 13.2.0, < 13.6.5 | 13.6.5
[Aspire.Cli.linux-x64](https://www.nuget.org/packages/Aspire.Cli.linux-x64) | >= 13.3.0, < 13.6.5 | 13.6.5
[Aspire.Cli.linux-arm64](https://www.nuget.org/packages/Aspire.Cli.linux-arm64) | >= 13.3.0, < 13.6.5 | 13.6.5
[Aspire.Cli.linux-musl-x64](https://www.nuget.org/packages/Aspire.Cli.linux-musl-x64) | >= 13.3.0, < 13.6.5 | 13.6.5
[Aspire.Cli.osx-x64](https://www.nuget.org/packages/Aspire.Cli.osx-x64) | >= 13.3.0, < 13.6.5 | 13.6.5
[Aspire.Cli.osx-arm64](https://www.nuget…
Source: GitHub Security Advisories · 2026-11-11