Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
.NET
.NET NuGet
Not in CISA KEV
MEDIUM severity

Umbraco.AI discloses sensitive application configuration valuesGHSA-q3v2-xj35-9grx

MEDIUM

GHSA-q3v2-xj35-9grx is a medium-severity (CVSS 4.9) vulnerability in Umbraco.AI. A fix is available for Umbraco.AI — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Jul 14, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
.NETUmbraco.AI

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what the affected installation stores in configuration, enable further compromise. Exploitation requires access to the AI section of the backoffice and a specific custom AI provider, which limits real-world exposure.

Patches

Patched in 1.14.0

Workarounds

Since the patch is a breaking change and requires a version jump, it is not recommended to try and implement a workaround.

Resources

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
.NETNuGetUmbraco.AIall versions1.14.0dotnet add package Umbraco.AI --version 1.14.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Umbraco.AI, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update Umbraco.AI to 1.14.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q3v2-xj35-9grx is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what the affected installation stores in configuration, enable further compromise. Exploitation requires access to the AI section of the backoffice and a specific custom AI provider, which limits real-world exposure. ### Patches Patched in 1.14.0 ### Workarounds Since the patch is a breaking change and
O3 Security · Impact-Aware SCA

Is GHSA-q3v2-xj35-9grx in your dependencies?

Find it across NuGet, including transitive dependencies.

Scan my dependencies How O3 SCA works
Umbraco.AI discloses sensitive application configuration…