CVE-2026-102870: Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-102870 · Severity: high · CVSS 8.8 · Published 2026-10-13

A code injection vulnerability in the Blazor WebAssembly debugging tool allows attackers to execute arbitrary code on a developer's machine during debugging sessions. When a developer evaluates expressions on debugged applications, an attacker can embed malicious code through application data like object names or string values, leading to complete compromise of the development environment.

Technologies: Microsoft Asp.Net Core. Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-102870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102870 being exploited in the wild.
How severe is CVE-2026-102870?
High severity, with a CVSS score of 8.8, published 13 October 2026.
Which products and versions are affected?
Microsoft Asp.Net Core 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for CVE-2026-102870?
Yes. Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet): upgrade to 10.0.13 or later. Until then: Do not evaluate expressions involving untrusted or attacker-controlled data in the Blazor WebAssembly debugger until the package is updated. Upgrade to the latest supported version of .NET and update Microsoft.AspNetCore.Components.WebAssembly.Server to the patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102870 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-102870?
Check whether you run Microsoft Asp.Net Core or Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet): upgrade to 10.0.13 or later
    dotnet add package Microsoft.AspNetCore.Components.WebAssembly.Server --version 10.0.13

Do not evaluate expressions involving untrusted or attacker-controlled data in the Blazor WebAssembly debugger until the package is updated. Upgrade to the latest supported version of .NET and update Microsoft.AspNetCore.Components.WebAssembly.Server to the patched version.

Technical details

The Blazor WebAssembly debug proxy generates C# source code by embedding debugger expression values, including ToString() results and class names, without consistent escaping. Attacker-controlled data can escape the generated string literal, resulting in code injection that executes during expression evaluation. This requires network access and user interaction (expression evaluation) in a debugging session; no prior authentication is needed.

Affected products

  • Microsoft ASP.NET Core 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1

Identifiers

  • CVE-2026-102870
  • GHSA-g27p-qf6j-c96c

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.