NuGetGallery, the package repository backend powering nuget.org, contains a vulnerability in its handling of .nuspec files. Due to insufficient input validation, an attacker can craft a nuspec file with malicious metadata that triggers cross package metadata injection. This injection can lead to remote code execution and arbitrary blob writes by exploiting URI fragment injection through unsanitized package identifiers. The flaw allows writes to arbitrary blobs within the storage container, not limited to package files, risking tampering with existing stored content. The vulnerability affects versions prior to commit 0e80f87628349207cdcaf55358491f8a6f1ca276, where the issue has been patched.

The vulnerability enables attackers with at least limited privileges (PR:L) to perform remote code execution and arbitrary writes to blobs in the NuGetGallery storage container. This can result in tampering with existing package content and potentially compromise the integrity and security of the package repository. The CVSS score of 9.6 (critical) reflects the high impact on integrity and availability without requiring user interaction.

A patch fixing this vulnerability has been committed in NuGetGallery at commit 0e80f87628349207cdcaf55358491f8a6f1ca276. Users and administrators should update to this fixed version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch to affected deployments. Patch status beyond the commit is not explicitly stated; verify with the vendor advisory for the latest remediation guidance.