Microsoft Aspire CLI: Local privilege escalation through insecure temporary directory
Summary
The Aspire CLI, part of Microsoft's .NET Aspire framework, creates temporary files in a directory with insecure permissions. A local attacker with a valid account can influence MSBuild response-file discovery and run code with the privileges of the user running the CLI. The vendor advisory lists Linux and macOS (x64 and Arm64) and does not list Windows. User interaction is required, and no exploitation is known.
Affected
- Aspire.Cli from 13.2.0 before 13.6.5 according to the Microsoft advisory (linux-x64 and linux-arm64 from 13.3.0, npm package from 13.4.2)
- The CVE record lists 13.5.4 before 13.6.5 as the affected range; the vendor advisory range is wider and is used here
- Platforms: Linux and macOS, x64 and Arm64. Windows is not listed.
- Builds started by aspire sdk generate, aspire sdk dump and aspire sdk export are affected
Fixed in
- Update the Aspire CLI to version 13.6.5 or later
- If installed as a .NET tool, update the Aspire.Cli package
- The fix ships separately from the .NET SDK and runtime, so a standard .NET update does not fix it
Workaround
- Unknown. No vendor workaround is published.
- Until patched: avoid running the Aspire CLI on shared multi-user hosts or shared build agents
- Check that temporary directories used by build tooling are private to the user
Exploitation
- CISA SSVC: Exploitation none, not automatable, total technical impact
- Rapid7: Exploitation Less Likely, not publicly disclosed
- Not listed in CISA KEV; no public proof of concept or known exploitation in the wild
Our recommendation
- Inventory Aspire CLI installs on developer machines, CI runners and shared Linux or macOS hosts, including .NET global tools and npm global installs
- Update to Aspire CLI 13.6.5 or later, including the npm package
- Prioritise shared build hosts and multi-user systems
- Monitor for public proof-of-concept code and exploitation reports
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-120778 msrc.microsoft.com
- Microsoft Aspire advisory (GitHub issue 22101) github.com
- CVE Record CVE-2026-120778 www.cve.org
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Strix: CVE-2026-120778 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:26.
Original description (NVD)
Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.