Repository navigation
Security fix
This release includes the fix for CVE-2026-105544, an elevation of privilege vulnerability in the VSTest artifact post-processor. The post-processor could consume a forged executionComplete.json written by another local user, and then run attacker-controlled output handling.
Affected: Microsoft.TestPlatform.CLI 18.11.0 and earlier. Every version from 18.11.1 on is fixed, including 18.12.0.
Microsoft.TestPlatform.CLI is the VSTest build that we ship into the .NET SDK. The recommended way to get this fix is to update your .NET SDK to the latest patched version, see the advisory for the SDK versions.
The fix is also released in the Microsoft.TestPlatform.CLI package, for completeness. That package is rarely used directly. It is not a dependency of Microsoft.NET.Test.Sdk or Microsoft.TestPlatform, so those packages do not bring it in.
Details: #16654 and dotnet/announcements#517
Using custom Docker images or Nano Server? See #16652
What's Changed
- Fix TestCaseStart/Stop events dropped for data-driven tests with shared TestCase.Id by Jakub Jareš (@nohwnd) in #16033
- Stop the discovery manager factory from shadowing discoveryCriteria by Jakub Jareš (@nohwnd) in #16391
- Gate the HTTP link checker on a fingerprint of the broken links by Jakub Jareš (@nohwnd) in #16413
- Quote boolean conditions in shipped Microsoft.TestPlatform.targets by Jakub Jareš (@nohwnd) in #16404
- Obsolete API hygiene: the compatibility-safe changes by Azat Mukhametshin (@azat-msft) in #16420
- Add xxHash128 test ids, available but not default by Azat Mukhametshin (@azat-msft) in #16378
- Isolate attachment manager test temporary files by Matt Mitchell (@mmitche) in #16463
- Test ids report logger by Azat Mukhametshin (@azat-msft) in #16443
- Isolate code coverage files in published output by Azat Mukhametshin (@azat-msft) in #16483
- Preserve OutputType for Android test projects by Jonathan Peppers (@jonathanpeppers) in #16496
- Fix dotnet host resolution under proot (ARM64/Termux) by Azat Mukhametshin (@azat-msft) in #16462
- Mark the xxHash128 test id API as experimental by Azat Mukhametshin (@azat-msft) in #16465
- Ship Microsoft.Diagnostics.NETCore.Client in Microsoft.TestPlatform and Portable packages by Jakub Jareš (@nohwnd) in #16633
- Fix localized resource paths in CLI source-build/non-Windows packages by Jakub Jareš (@nohwnd) in #16644
Full Changelog: v18.11.0...v18.12.0
