CVE-2026-120778: Local Elevation of Privilege via Insecure Temporary Directory Handling and MSBuild Response File Hijacking in Microsoft .NET Aspire CLI

Vulnerability ID: CVE-2026-120778
CVSS Score: 7.3
Published: 2026-11-11

A local elevation of privilege vulnerability exists in the Microsoft .NET Aspire CLI (Aspire.Cli) versions 13.5.4 prior to 13.6.5. When executing SDK management commands (aspire sdk generate, aspire sdk dump, and aspire sdk export), the CLI creates temporary project directories inside the shared operating system temporary folder (such as /tmp on Unix-like systems) without restricting directory permissions or disabling MSBuild automatic response file resolution. A local, low-privileged attacker on a multi-user system can place a crafted Directory.Build.rsp file in the shared temporary directory hierarchy. When a victim user executes an affected Aspire CLI command, MSBuild traverses upward, ingests the attacker-controlled response file, and executes arbitrary commands in the security context of the victim user.

TL;DR

Microsoft .NET Aspire CLI (< 13.6.5) creates temporary MSBuild projects in world-writable shared /tmp directories without disabling automatic response file discovery. Local attackers on multi-user systems can plant malicious Directory.Build.rsp files in /tmp to achieve arbitrary code execution and privilege escalation when another user runs aspire sdk commands.

Technical Details

• CVE ID: CVE-2026-120778
• Vulnerability Class: CWE-379 (Creation of Temporary File in Directory with Insecure Permissions)
• Attack Vector: Local (Shared /tmp Directory & MSBuild Response File Traversal)
• CVSS v3.1 Score: 7.3 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
• Impact: Local Elevation of Privilege (Arbitrary Code Execution as Victim User)
• Affected Versions: Microsoft .NET Aspire CLI 13.5.4 to < 13.6.5
• Patched Version: Microsoft .NET Aspire CLI 13.6.5
• CISA KEV Status: Not Listed

Affected Systems

• Microsoft .NET Aspire CLI (Aspire.Cli)
• Aspire.Cli (.NET Aspire CLI): >= 13.5.4, < 13.6.5 (Fixed in: 13.6.5)

Code Analysis

Commit: 1ecd7cc

Isolate SDK temporary working directories under ASPIRE_HOME with 0700 permissions and pass -noAutoResponse to dotnet restore/build.

Commit: c408ec5

Associated servicing commit on release/13.6 branch for CVE-2026-120778.

Commit: 6cfe6b4

Associated servicing commit on release/13.6 branch for CVE-2026-120778.

Commit: c3d649d

Associated servicing commit on release/13.6 branch for CVE-2026-120778.

Commit: b33d222

Associated servicing commit on release/13.6 branch for CVE-2026-120778.

Mitigation Strategies

• Upgrade Microsoft .NET Aspire CLI (Aspire.Cli) to version 13.6.5 or later.
• Isolate the TMPDIR environment variable on Unix/Linux/macOS systems to a user-owned directory with 0700 permissions.
• Audit shared /tmp and /var/tmp directories for unexpected Directory.Build.rsp, Directory.Build.props, and Directory.Build.targets files.
• Use containerized or namespace-isolated /tmp mounts for CI/CD build runners executing aspire sdk commands.

Remediation Steps:

1. Run dotnet workload update and dotnet tool update -g Aspire.Cli to upgrade to version 13.6.5 or higher.
2. Confirm the patched version is active by running aspire --version and verifying the output is >= 13.6.5.
3. Remove any leftover /tmp/aspire-sdk-* directories and /tmp/aspire-deprecated-scan.log files on shared Unix hosts.

References

• MSRC Security Update Guide: CVE-2026-120778
• CVE.org Record: CVE-2026-120778
• NVD Vulnerability Detail: CVE-2026-120778
• GitHub Fix Commit: 1ecd7cc70b5a5a5b8571fe3af69faa1646b8de47
• GitHub Pull Request #22071
• GitHub Release Tag: v13.6.5
• GitHub Commit: c408ec5bf44e43203c278990a43aea93145248f3
• GitHub Commit: 6cfe6b409805bb21775623d501aa1475cb9ee25c
• GitHub Commit: c3d649db33907f697f5fa29bdaae5d92b8ba975c
• GitHub Commit: b33d222049f1ecc3bc7257ec07b622fe550b2580

Read the full report for CVE-2026-120778 on our website for more details including interactive diagrams and full exploit analysis.