The vulnerability in NuGetGallery stems from insufficient input validation in handling .nuspec files, specifically allowing cross package metadata injection. Attackers can exploit URI fragment injection via unsanitized package identifiers to control blob storage paths, enabling arbitrary writes to blobs in the storage container. This can result in remote code execution and unauthorized modification of stored content. The issue is fixed in commit 0e80f87628349207cdcaf55358491f8a6f1ca276, which should be applied to affected versions.

Successful exploitation can lead to remote code execution and arbitrary writes to blobs within the storage container, potentially allowing attackers to tamper with existing package content or inject malicious payloads. The vulnerability does not impact confidentiality but has high integrity and availability impacts. The CVSS score is 9.6 (critical), reflecting the ease of network exploitation with low complexity and no user interaction required, but requiring low privileges.

A patch fixing this vulnerability is available and has been committed in commit 0e80f87628349207cdcaf55358491f8a6f1ca276. Users should update NuGetGallery to this fixed version or later to remediate the issue. No additional vendor advisory is provided, so patch status is based on the commit information. There is no indication that this is a cloud service with vendor-managed remediation. No known exploits are reported in the wild at this time.