AI agents: use the documentation index at llms.txt to locate machine-readable pages. This section is indexed by https://docs.particular.net/security-advisories/llms.txt. The markdown version of this page is served as plain text. An MCP server at /mcp serves the same content via the search_docs and read_doc tools; it is read-only and needs no credentials. Markdown versions of documentation pages are available by appending .md to the page URL. Directory URLs use index.md. They are served as text/plain because some retrieval backends reject text/markdown.

GHSA-6c8g-7p36-r338

Security Advisory Id GHSA-6c8g-7p36-r338

This advisory discloses a security vulnerability Patches for components to update their dependencies to avoid references that have the GHSA-6c8g-7p36-r338 security advisory: SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant).

Patch releases

ComponentVersionWhere to get it
NServiceBus.Storage.MongoDB3.0.7NuGet
NServiceBus.Storage.MongoDB.TransactionalSession3.0.7NuGet
NServiceBus.Storage.MongoDB4.2.2NuGet
NServiceBus.Storage.MongoDB.TransactionalSession4.2.2NuGet
NServiceBus.Storage.MongoDB5.0.3NuGet
NServiceBus.Storage.MongoDB.TransactionalSession5.0.3NuGet
NServiceBus.Storage.MongoDB6.0.4NuGet
NServiceBus.Storage.MongoDB.TransactionalSession6.0.4NuGet
NServiceBus.Storage.MongoDB7.0.3NuGet
NServiceBus.Storage.MongoDB.TransactionalSession7.0.3NuGet

How to know if you are affected

You are affected if you are using previous versions of any of these components, but this doesn't necessarily mean you are vulnerable.

Symptoms

For NuGet packages your projects have the setting NuGetAuditMode set to all and see transitive dependency warnings at build time that mention Particular packages.

Other components of the platform will not have any symptoms.

When to upgrade

You should upgrade immediately if you are affected. Otherwise, you should upgrade during your next maintenance window.

In this article