Vulnerable Library - microsoft.sourcelink.github.8.0.0.nupkg

Sample Path to Dependency File: /KartaViewSharp.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.build.tasks.git/8.0.0/microsoft.build.tasks.git.8.0.0.nupkg

## Vulnerabilities | Vulnerability | Severity |

CVSS | Dependency | Type | Fixed in (microsoft.sourcelink.github.8.0.0.nupkg version) | Remediation Possible** | | ------------- | ------------- | ----- | ----- | ----- | ------------- | --- | | [CVE-2026-62900](https://www.mend.io/vulnerability-database/CVE-2026-62900) |

Medium | 5.9 | microsoft.build.tasks.git.8.0.0.nupkg | Transitive | N/A* | ❌ |

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

CVE-2026-62900

### Vulnerable Library - microsoft.build.tasks.git.8.0.0.nupkg

MSBuild tasks providing git repository information.

Library home page: https://api.nuget.org/packages/microsoft.build.tasks.git.8.0.0.nupkg

Sample Path to Dependency File: /KartaViewSharp.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.build.tasks.git/8.0.0/microsoft.build.tasks.git.8.0.0.nupkg

Dependency Hierarchy: - microsoft.sourcelink.github.8.0.0.nupkg (Root Library) - :x: **microsoft.build.tasks.git.8.0.0.nupkg** (Vulnerable Library)

Found in base branch: master

### Vulnerability Details

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

Publish Date: 2026-08-11

URL: CVE-2026-62900

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2026-08-11

Fix Resolution: microsoft.build.tasks.git - 10.0.303,microsoft.build.tasks.git - 10.0.111,microsoft.sourcelink.azurerepos.git - 10.0.303,microsoft.sourcelink.azurerepos.git - 10.0.111,Microsoft.SourceLink.AzureRepos.Git - 10.0.303,Microsoft.SourceLink.AzureRepos.Git - 10.0.111

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Do you want to work on this issue?

microsoft.sourcelink.github.8.0.0.nupkg: 1 vulnerabilities (highest severity is: 5.9) #111

Company

Community

Support

Connect