{"id":"GHSA-6r78-m64m-qwcf","aliases":[],"url":"https://o3.security/vulnerability/GHSA-6r78-m64m-qwcf","summary":"Moq v4.20.0-rc to 4.20.1 share hashed user data","details":"Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.\n\nMoq v4.20.2 has removed this functionality.","published":"2023-08-10T19:25:23Z","modified":"2024-12-01T05:31:02.237947Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"moq","fixedVersion":"4.20.2"}],"fix":{"url":"https://github.com/moq/moq/pull/1363","label":"moq/moq#1363"},"references":[{"type":"WEB","url":"https://github.com/moq/moq/issues/1374"},{"type":"WEB","url":"https://github.com/moq/moq/pull/1363"},{"type":"WEB","url":"https://github.com/moq/moq/pull/1375"},{"type":"PACKAGE","url":"https://github.com/moq/moq"},{"type":"WEB","url":"https://www.cazzulino.com/sponsorlink.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-12-01T05:31:02.237947Z"}}