Loading vulnerability…
Reflected XSS in ASP.NET Core Blazor WebAssembly development-server debug page
CVE-2026-96230 is a reflected cross-site scripting vulnerability in the Blazor WebAssembly development-server debug page implemented by Microsoft.AspNetCore.Components.WebAssembly.Server. The unauthenticated debug endpoint used by dotnet watch reflects exception text without encoding it appropriately for web page generation, allowing an unauthenticated network attacker to inject script across origins. Exploitation requires user interaction. Microsoft titles the issue an ASP.NET Core remote code execution vulnerability, but the established technical mechanism is script injection; a server-side code-execution chain is not specified. Affected package versions span Windows, Linux, and macOS on all architectures.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits cross-origin script injection through the development-server debug page. The vulnerability has a CVSS v3.1 score of 8.8, with high potential confidentiality, integrity, and availability impacts and required user interaction. The execution context and any chain extending script injection to server-side code execution are not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified.
Patch, then assume compromise.
Install the latest applicable .NET runtime or SDK and update explicit Microsoft.AspNetCore.Components.WebAssembly.Server package references to the patched release for the corresponding branch: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2. For SDKs installed through Visual Studio, apply the corresponding Visual Studio update. Restart applications after updating the runtime or SDK. Recompile and redeploy affected self-contained applications. For distribution-managed installations, apply the applicable vendor security package updates.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.