Cross-Site Scripting Vulnerability in NuGet Gallery's Autolinks Handling
CVE-2024-37304
Currently unrated
What is CVE-2024-37304?
NuGet Gallery, the popular package repository for .NET, is vulnerable due to improper handling of autolinks in Markdown content. While it effectively filters out JavaScript from standard links, the platform fails to properly sanitize autolinks, allowing attackers to inject JavaScript code. This vulnerability can be exploited for Cross-Site Scripting (XSS) attacks, potentially leading to malicious code execution in users' browsers when they click on unsanitized links. A patch addressing this issue is available in version 2024.05.28.