GitHub Advisoryadvisory · NuGet

GHSA-6r78-m64m-qwcf Moq v4.20.0-rc to 4.20.1 share hashed user data

LOW Published 2023-08-10 Modified 2023-08-25 Official page ↗

Ecosystem: NuGet
Packages: moq
Severity: Low
Reviewed: 2023-08-10

Affected packages

• NuGet moq: >= 4.20.0-rc, < 4.20.2 → fixed in 4.20.2

Description

Moq v4.20.0-rc to 4.20.1 include support for SponsorLink, which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this. Moq v4.20.2 has removed this functionality.

References

https://github.com/moq/moq/issues/1374 web
https://github.com/moq/moq/pull/1363 web
https://github.com/moq/moq/pull/1375 web
https://github.com/moq/moq package
https://www.cazzulino.com/sponsorlink.html web