Microsoft Blazor WebAssembly debugger: Code injection in expression evaluation

Summary

The Blazor WebAssembly debugger, shipped in the Microsoft.AspNetCore.Components.WebAssembly.Server and .DevServer NuGet packages, does not safely handle debugger expressions. When a developer evaluates an expression that contains attacker-controlled data, the value can escape a generated string literal and execute arbitrary code on the developer's machine. The attacker needs no privileges, but exploitation requires user interaction. The flaw affects a development-time tool, so production servers are generally out of scope.

Affected

• Microsoft.AspNetCore.Components.WebAssembly.Server and .DevServer packages: 10.0.0 to before 10.0.14 (.NET 10)
• Same packages: .NET 11 preview 11.0.0-preview.1 up to 11.0.0-rc.3.26522.148
• The official CVE record also lists broader .NET 10 and 11 runtime ranges and Visual Studio 2019, 2022 and 2026 builds. Exact Visual Studio fixed builds are unknown.

Fixed in

• .NET 10: 10.0.14 (Blazor WebAssembly packages, released October 25, 2026)
• .NET 11: rc.3 release
• Do not use 10.0.13 as a target. Microsoft revised the original October 13 advisory, which listed 10.0.13 and 11.0.0-rc.2 as fixes.
• Updating the runtime alone does not update NuGet package references in an application.

Workaround

• No vendor workaround is published. Patching is the stated remedy.
• Keep the Blazor WebAssembly debugger away from untrusted data.
• Limit debugging to developer machines and do not run debug packages on production systems.

Exploitation

• Vendor-confirmed exploitation: none found.
• Known exploitation: one tracker reports the vulnerability is not known to be exploited.
• Public proof-of-concept code: conflicting reports. Treat it as unconfirmed.

Our recommendation

• Update Blazor WebAssembly projects and their NuGet references to Microsoft.AspNetCore.Components.WebAssembly.Server and .DevServer 10.0.14 (or the .NET 11 rc.3 build), and do not stop at the runtime update.
• Patch developer workstations and build or dev servers first.
• Check whether debug packages are deployed on production systems and remove them there.
• Verify the fixed versions on the Microsoft Security Response Center page before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102870 msrc.microsoft.com
• GitHub Security Advisory GHSA-g27p-qf6j-c96c (dotnet/aspnetcore) github.com
• Microsoft .NET 10.0 update, October 25, 2026 support.microsoft.com
• .NET 10.0.14 release notes github.com
• Red Hat CVE record CVE-2026-102870 access.redhat.com
• dotnet/aspnetcore discussion 69791 (Blazor WebAssembly debugger) github.com
• GitLab advisory for Microsoft.AspNetCore.Components.WebAssembly.Server advisories.gitlab.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:25.