limbo.watch
Menu

In limbo for 1 day

GHSA-jxmf-523q-f7r7

Microsoft.VisualStudio.Web.CodeGenerators.Mvc on NuGet · published in dotnet/scaffolding

Read the advisory on GitHub ↗

Fixed in 8.0.24. Dependabot, npm audit and OSV-Scanner won’t flag this yet. Find it in your project

Facts

Severity
High · CVSS score 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
>= 8.0.0, <= 8.0.23As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
8.0.24
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
>= 9.0.0, <= 9.0.12As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
9.0.13
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
>= 10.0.0, <= 10.0.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
10.0.3
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
= 8.0.0-preview.1.23117.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
8.0.24
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
= 9.0.0-preview.1.24112.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
9.0.13
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
= 10.0.0-rc.1.25458.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
10.0.3
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
= 11.0.0-preview.1.26156.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
not stated
Affected versions (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
= 11.0.0-preview.1.26230.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGenerators.Mvc)
not stated
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
>= 8.0.0, <= 8.0.23As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
8.0.24
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
>= 9.0.0, <= 9.0.12As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
9.0.13
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
>= 10.0.0, <= 10.0.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
10.0.3
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
= 8.0.0-preview.1.23117.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
8.0.24
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
= 9.0.0-preview.1.24112.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
9.0.13
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
= 10.0.0-rc.1.25458.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
10.0.3
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
= 11.0.0-preview.1.26156.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
not stated
Affected versions (Microsoft.VisualStudio.Web.CodeGeneration.Design)
= 11.0.0-preview.1.26230.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.VisualStudio.Web.CodeGeneration.Design)
not stated
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.8.0)
>= 8.0.0, <= 8.0.33As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.8.0)
8.0.34
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.8.0)
= 8.0.0-rc.2.23480.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.8.0)
8.0.34
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.9.0)
>= 9.0.0, <= 9.0.22As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.9.0)
9.0.23
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.9.0)
= 9.0.0-preview.1.24081.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.9.0)
9.0.23
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.10.0)
>= 10.0.0, <= 10.0.14As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.10.0)
10.0.15
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.10.0)
= 10.0.0-preview.1.25120.3As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.10.0)
10.0.15
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.11.0)
= 11.0.0-preview.1.26104.118As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.11.0)
11.0.0
Affected versions (Microsoft.DotNet.Web.ProjectTemplates.11.0)
= 11.0.0-rc.3.26522.148As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.DotNet.Web.ProjectTemplates.11.0)
11.0.0
Affected versions (Microsoft.dotnet-scaffold-aspnet)
>= 9.0.0, <= 9.0.12As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold-aspnet)
not stated
Affected versions (Microsoft.dotnet-scaffold)
>= 10.0.0, <= 10.0.2As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold)
20.3.0
Affected versions (Microsoft.dotnet-scaffold)
>= 20.0.0-preview.1.26156.3, <= 20.1.0As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold)
20.3.0
Affected versions (Microsoft.dotnet-scaffold-aspnet)
= 9.0.0-preview.8.24467.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold-aspnet)
not stated
Affected versions (Microsoft.dotnet-scaffold-aspnet)
= 9.0.0-preview.9.24509.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold-aspnet)
not stated
Affected versions (Microsoft.dotnet-scaffold-aspnet)
= 10.0.0-rc.1.25458.5As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold-aspnet)
not stated
Affected versions (Microsoft.dotnet-scaffold-aspnet)
= 10.0.0-rc.1.25468.1As entered by the maintainer. Not reviewed.
Fixed in (Microsoft.dotnet-scaffold-aspnet)
not stated
CVE
CVE-2026-118741 · published
GitHub Advisory Database
Not reviewed
OSV.dev
Not present
Other CVEs pointing here
None found in the CVE List

If you use Microsoft.VisualStudio.Web.CodeGenerators.Mvc >= 8.0.0, <= 8.0.23

Upgrade to 8.0.24 or later. Dependabot, npm audit and OSV-Scanner won’t flag this yet.

Timeline

  1. 2026-11-11 01:17 UTC

    Published by the maintainers

    Cites CVE-2026-118741

  2. 2026-11-11 14:42 UTC

    First seen by Limbowatch

    not reviewed · not in OSV

  3. Waiting

    Reviewed by GitHub

  4. Waiting

    In OSV; scanners can see it

Machine-readable record: feed/GHSA-jxmf-523q-f7r7.json