Vulnerability CVE-2025-65955

[cezar06]

Magick.NET version

14.9.1

Environment (Operating system, version and so on)

Any

Description

vulnerability CVE-2025-65955

Steps to Reproduce

dotnet restore/dotnet build

Images

no need

[dlemstra]

This does not affect Magick.NET because its happening in the C++ part of the library that I am not using.

[cezar06]

In our codebase we are using Magick.NET-Q8-AnyCPU version 14.9.1, which appears in the list of affected packages here: GHSA-q3hc-j9x5-mp9m

[dlemstra]

It is but it shouldn't be 😁

[cezar06]

Then should we expect the package to not be detected as vulnerable soon? Or what is there to do

[send0xx]

To build without errors/warnings:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-q3hc-j9x5-mp9m" />
  </ItemGroup>

Waiting for the exclusion of nuget packages from the list marked as vulnerable 👀

[dlemstra]

I don't think I will spend time figuring out how to remove it from the list. I will publish a new release that fixes another security issue this weekend.

[martincostello]

I don't think I will spend time figuring out how to remove it from the list

You click the link on the right hand side:

See something to contribute? Suggest improvements for this vulnerability.

That opens a form where you can edit it, then I just deleted all the NuGet entries and submitted it for review.

[ericblade]

To build without errors/warnings:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-q3hc-j9x5-mp9m" />
  </ItemGroup>

Waiting for the exclusion of nuget packages from the list marked as vulnerable 👀

does not seem to work from here, mucking around in Unreal's build system. nor any other variation of NuGetAuditSuppress that i can find

[bangfalse]

@ericblade For Unreal Engine, you can't use NuGetAuditSuppress because their bundled version of .NET is 8.0.300 and NuGetAuditSuppress was added in 8.0.400.

To unblock builds, I added this to the top-level <PropertyGroup> in Engine/Source/Programs/AutomationTool/AutomationTool.csproj, Engine/Source/Programs/AutomationTool/AutomationUtils/AutomationUtils.Automation.csproj, and Engine/Source/Programs/AutomationTool/Gauntlet/Gauntlet.Automation.csproj:

    <WarningsNotAsErrors>$(WarningsNotAsErrors);NU1901;NU1902;NU1903</WarningsNotAsErrors>

This will make the NuGet security warnings actually be treated as warnings instead of errors for anything under a critical level vulnerability.