visual-studionugetnuget-package

Visual Studio NuGet says I have 3 vulnerable packages, then shows me 0

So NuGet says I have 3 vulnerable packages. But when I then ask for a listing of the vulnerable packages, I get 0. What is going on here?

Update: And it gets weirder. I updated Visual Studio and now:

  1. Looking at NuGet for the solution it says I have 1 vulnerable package, but shows 0.
  2. Looking at NuGet for my main web project it says I have 5 vulnerable packages - and shows all 5.

So clearly there's some bugs around this in the latest Visual Studio pre-release.

enter image description here

Solution

  • Ways to check risk:

    dotnet list package --vulnerable

    or (including transitive packages):

    dotnet list package --vulnerable --include-transitive

    If there is really some risk packages there, then you will get:

    enter image description here

    NuGet obtains its information regarding Common Vulnerabilities and Exposures (CVE) and GitHub Security Advisories (GHSA) directly from the centralized GitHub Advisory Database. This database provides listings of known vulnerabilities, where a CVE is a list of publicly disclosed computer security flaws, and a GHSA is a GitHub Security Advisory. Nuget package management risk report based on this.

    So if you couldn't find the risk packages via the command, then it s believed that the situation you encountered is caused by temporary issue of Visual Studio preview version.