Description
Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Aspire.Cli | 13.5.4 – < 13.6.5 | 13.6.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @microsoft/aspire-cli | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| npm | @microsoft/aspire-cli-linux-arm64 | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| npm | @microsoft/aspire-cli-linux-musl-x64 | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| npm | @microsoft/aspire-cli-linux-x64 | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| npm | @microsoft/aspire-cli-osx-arm64 | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| npm | @microsoft/aspire-cli-osx-x64 | >= 13.4.2, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli | >= 13.2.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli.linux-arm64 | >= 13.3.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli.linux-musl-x64 | >= 13.3.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli.linux-x64 | >= 13.3.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli.osx-arm64 | >= 13.3.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
| NuGet | Aspire.Cli.osx-x64 | >= 13.3.0, < 13.6.5 | 13.6.5 | GHSA-q6jf-24jf-m3cg |
Advisories 1
- MSRC-CVE-2026-120792 Aspire Information Disclosure Vulnerability Microsoft Security Response Center · Nov 11, 2026
References
- Aspire Information Disclosure Vulnerability vendor-advisory patch