Collect nuget vulnerabilities

[pombredanne]

See https://github.com/pombredanne/list-nuget-vulns
from @Stef16Robbe https://github.com/Stef16Robbe/list-nuget-vulns for some hints

[pombredanne]

See also the Nuget.org api (with nuget-inspector) where the package metadata may contain vulnerability details.

[chinyeungli]

Not sure is this helpful, but this is one of the approahces that I use to check for nuget's vulnerabilities:

Environment: running on Windows with .NET installed.

dotnet --version
9.0.303

Next, created a temporary directory and initialized a new project:

mkdir tmp && cd tmp
dotnet new console

Then add a specific package to the project, for example:

dotnet add package Npgsql --version 7.0.2

After that, used dotnet list package --vulnerable to identify if there is any vulnerabilities

C:\tmp>dotnet list package --vulnerable

The following sources were used:
   https://api.nuget.org/v3/index.json
   C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\

Project `tmp` has the following vulnerable packages
   [net9.0]:
   Top-level Package      Requested   Resolved   Severity   Advisory URL
   > Npgsql               7.0.2       7.0.2      High       https://github.com/advisories/GHSA-x9vc-6hfv-hg8c

(If want to check if dependencies contains vulns: use dotnet list package --include-transitive)