Local code execution via NuGet package squatting

Command injection in Microsoft Visual Studio allows local users to execute code after user interaction with a squatted NuGet package. Microsoft attributes the flaw to NuGet package squatting but has not disclosed the command-construction locus or how package-controlled data reaches it. Exploitation requires a user to trigger the malicious package workflow, after which code runs with that user's privileges.