CVE-2026-120778: Local Elevation of Privilege via Insecure Temporary Directory Handling and MSBuild Response File Hijacking in Microsoft .NET Aspire CLI

Vulnerability ID: CVE-2026-120778

CVSS Score: 7.3

Published: 2026-11-11

A local elevation of privilege vulnerability exists in the Microsoft .NET Aspire CLI ( Aspire.Cli ) versions 13.5.4 prior to 13.6.5. When executing SDK management commands ( aspire sdk generate , aspire sdk dump , and aspire sdk export ), the CLI creates temporary project directories inside the shared operating system temporary folder (such as /tmp on Unix-like systems) without restricting directory permissions or disabling MSBuild automatic response file resolution. A local, low-privileged attacker on a multi-user system can place a crafted Directory.Build.rsp file in the shared temporary directory hierarchy.…