Microsoft Fixes Code Injection Flaw in ASP.NET Core Debugger

Microsoft has released patches for a high-severity code injection vulnerability in its ASP.NET Core framework. The flaw, tracked as CVE-2026-102870, allows unauthorized attackers to execute code on a developer’s machine through the Blazor WebAssembly debugger. This issue affects multiple versions of the Microsoft.AspNetCore.Components.WebAssembly.Server NuGet package.

The vulnerability stems from improper control of code generation within the debug proxy. When developers evaluate expressions during debugging, the proxy generates and compiles C# source code. Certain values from the application, such as class names or ToString() results, are embedded in this source without consistent escaping. An attacker-controlled value can break out of the string literal and execute arbitrary code.

Technical Context and Severity

The National Vulnerability Database rates CVE-2026-102870 as high severity with a CVSS score of 8.8. The weakness is classified under CWE-94, which covers improper control of code generation. The attack vector is network-based, requiring low complexity and no privileges, but it does require user interaction. Specifically, a developer must evaluate an expression during a debugging session for the exploit to succeed.

This incident follows other recent security updates from Microsoft. As Threat Times reported on October 13, 2026, a critical path traversal flaw in Visual Studio Code allowed remote code execution. On the same date, a critical use-after-free vulnerability in Windows Message Queuing was disclosed. These events highlight ongoing scrutiny of development tools and underlying operating system components.

Affected Versions and Platforms

The vulnerability impacts projects using specific versions of the Microsoft.AspNetCore.Components.WebAssembly.Server package. Versions 10.0.0 through 10.0.12 are vulnerable, with 10.0.13 providing the fix. Additionally, preview versions 11.0.0-preview.1 through 11.0.0-rc.1 are affected, while 11.0.0-rc.2.26478.115 resolves the issue. The flaw affects developers on Windows, Linux, and macOS across all architectures.

Microsoft Visual Studio 2022 versions prior to 17.14.42 and Visual Studio 2026 versions prior to 18.10.4 are also listed in the NVD record as affected. Developers using these IDE versions should verify their installed package versions. The advisory notes that the issue is specific to the Blazor WebAssembly debug proxy and does not affect production deployments of the applications themselves.

What should you do?

Developers should immediately check their project dependencies for the Microsoft.AspNetCore.Components.WebAssembly.Server package. If the version falls within the affected ranges, update to the patched version. Organizations should review their build pipelines to ensure they are not pulling vulnerable packages. Monitoring for any further advisories from Microsoft regarding this CVE is recommended.