.NET › Assemblies & NuGet

How do you audit a .NET project's dependencies for known security vulnerabilities using NuGet tooling?

Advanced

Answer

`dotnet list package --vulnerable` (optionally with --include-transitive) scans all direct and transitive package references against the NuGet vulnerability database (sourced from GitHub Advisory Database) and reports any known CVEs with severity ratings, letting teams proactively identify and upgrade vulnerable dependencies before they become an incident, often integrated as a CI pipeline gate.

dotnet list package --vulnerable --include-transitive

# Output flags any package with a known CVE, e.g.:
# > System.Text.Json 6.0.0 : High severity - GHSA-xxxx

Real-world example A CI pipeline fails the build automatically whenever `dotnet list package --vulnerable` reports a High or Critical severity vulnerability, preventing known-vulnerable dependencies from ever reaching a production deployment.

Common follow-ups: How often should this scan run in a CI/CD pipeline?;What's the difference between a vulnerable direct dependency and a vulnerable transitive one for remediation?

CI/CD Publishing & Deployment;Assemblies & NuGet