CVE-2026-102870

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.Components.WebAssembly.Server versions 11.0.0-preview.1 through 11.0.0-rc.1

Description Improper control of code generation in ASP.NET Core allows an unauthorized attacker to execute code over a network. Specifically, the Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values from the application being debugged, such as ToString() results, descriptions, and class names, are embedded in the generated source without consistent escaping. An attacker-controlled value can escape the generated string literal, leading to code execution on a developer's machine when the developer evaluates an expression during debugging.

Recommendations Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2.26478.115.