NuGet — Vulnerabilities & Security Advisories 4

NuGet serves as the primary package manager for .NET development, enabling developers to integrate pre-built libraries into their applications. Historically, common vulnerabilities include remote code execution through malicious packages, cross-site scripting flaws in package metadata, and privilege escalation via compromised build processes. The platform has faced security incidents where attackers uploaded malicious packages with names similar to legitimate ones, leading to supply chain attacks. While NuGet has implemented features like package verification and mandatory TLS, the 4 CVEs on record highlight ongoing risks in dependency management, particularly around package integrity and secure build practices.