Security fix
This release fixes CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.
Affected: Microsoft.TestPlatform.CLI 18.11.0.
Fixed in: Microsoft.TestPlatform.CLI 18.11.1.
Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.
The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.
Details: #16654 and dotnet/announcements#517
Using custom Docker images or Nano Server? See #16652
What's Changed
- Security fix for CVE-2026-105544, see #16654
- Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by @nohwnd in #16632
- Fix localized resource paths in CLI source-build packages by @nohwnd in #16643
Full Changelog: v18.11.0...v18.11.1