A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values. An attacker who successfully exploited the vulnerability could perform cross-site scripting attacks and run scripts in the security context of the user viewing the malicious content. To exploit this vulnerability, an attacker with permissions to upload packages could publish specially crafted content on a gallery page. The security update addresses the vulnerability by correcting how NuGetGallery sanitizes input.
Gabriel Thau