CVE-2026-96230

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Components.WebAssembly.Server versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.Components.WebAssembly.Server versions 9.0.0 through 9.0.20 Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.Components.WebAssembly.Server versions 11.0.0-preview.1 through 11.0.0-rc.1

Description Improper neutralization of input during web page generation allows an unauthorized attacker to execute code over a network. Specifically, the Blazor WebAssembly development-server debug page can reflect unencoded exception text, enabling cross-origin script injection through the unauthenticated / framework/debug endpoint used by dotnet watch.

Recommendations Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 9.0.0 through 9.0.20 to version 9.0.21. Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.Components.WebAssembly.Server versions 11.0.0-preview.1 through 11.0.0-rc.1 to version 11.0.0-rc.2. Recompile and redeploy any self-contained applications targeting the affected versions.