CVE-2026-102870: Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
(updated )
Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including ToString() results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer’s machine when the developer evaluates an expression during debugging.
References
- github.com/advisories/GHSA-g27p-qf6j-c96c
- github.com/dotnet/announcements/issues/445
- github.com/dotnet/announcements/issues/492
- github.com/dotnet/aspnetcore/discussions/69791
- github.com/dotnet/aspnetcore/discussions/70039
- github.com/dotnet/aspnetcore/security/advisories/GHSA-g27p-qf6j-c96c
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102870
- nvd.nist.gov/vuln/detail/CVE-2026-102870
Code Behaviors & Features
Detect and mitigate CVE-2026-102870 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →