CVE-2026-120778: Microsoft Security Advisory CVE-2026-120778 - Aspire Elevation of Privilege Vulnerability
Microsoft is releasing this security advisory to provide information about a vulnerability in the Aspire CLI. This advisory provides guidance on updating affected applications and components.
An insecure temporary directory used by Aspire CLI-generated builds can allow a local attacker to influence MSBuild response-file discovery and execute code with the privileges of the developer running the CLI.
References
- github.com/advisories/GHSA-m63f-xhvm-6mv5
- github.com/dotnet/announcements/issues/519
- github.com/microsoft/aspire/commit/1ecd7cc70b5a5a5b8571fe3af69faa1646b8de47
- github.com/microsoft/aspire/issues/22101
- github.com/microsoft/aspire/pull/22071
- github.com/microsoft/aspire/releases/tag/v13.6.5
- github.com/microsoft/aspire/security/advisories/GHSA-m63f-xhvm-6mv5
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778
- nvd.nist.gov/vuln/detail/CVE-2026-120778
Code Behaviors & Features
Detect and mitigate CVE-2026-120778 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →