Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability

Summary

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including `ToString()` results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer's machine when the developer evaluates an expression during debugging. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/445 ## CVSS Details - **Version:** 3.1 - **Severity:** High - **Score:** 8.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - **Weakness:** CWE-94 (Improper Control of Generation of Code ('Code Injection')) ## Affected Platforms - **Platforms:** Windows, Linux, macOS - **Architectures:** All ## <a name="affected-packages"></a>Affected Packages The vulnerability affects Microsoft .NET projects that use an affected package version listed below. Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 10.0.0, <= 10.0.13 | 10.0.14 [Microsoft.AspNetCore.Components.WebAssembly.Server](https://www.nuget.org/packages/Microsoft.AspNetCore.Components.WebAssembly.Server) | >= 11.0.0-preview.1, < 11.0.0-rc.3.26522.148 | 11.0.0-rc.3.26522.148 ## Advisory FAQ ### <a name="how-affected"></a>How do I know if I am affected? You are affected if you use a vulnerable version of `Microsoft.AspNetCo…

Remediation

1. Inventory every Microsoft.AspNetCore.Components.WebAssembly.Server deployment, including staging.
2. Upgrade Microsoft.AspNetCore.Components.WebAssembly.Server to the fixed version for your release line, listed under Affected versions.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/advisories/GHSA-g27p-qf6j-c96c
• Referencehttps://github.com/dotnet/aspnetcore/security/advisories/GHSA-g27p-qf6j-c96c
• Referencehttps://github.com/dotnet/announcements/issues/445
• Referencehttps://github.com/dotnet/aspnetcore/discussions/69791
• Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-102870
• Referencehttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102870
• Referencehttps://github.com/dotnet/announcements/issues/492
• Referencehttps://github.com/dotnet/aspnetcore/discussions/70039