Microsoft ASP.NET Core: Cross-site scripting in Blazor WebAssembly debugging

Summary

Microsoft's ASP.NET Core components for Blazor WebAssembly contain a cross-site scripting flaw (CWE-79) in the debug endpoint of the development server. An unauthenticated remote attacker can inject script that runs in the browser of a user who opens a crafted link or page, for example to act within the victim's session. Exploitation requires the debug middleware (UseWebAssemblyDebugging) to be active and user interaction. Microsoft's title says Remote Code Execution, but the documented mechanism is script injection.

Affected

• Microsoft.AspNetCore.Components.WebAssembly.Server 8.0 before 8.0.32
• Microsoft.AspNetCore.Components.WebAssembly.Server 9.0.0 to 9.0.20
• Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.0 to 10.0.12
• Microsoft.AspNetCore.Components.WebAssembly.Server 11.0.0-preview.1 before 11.0.0-rc.2
• Visual Studio 2022 version 17.14 before build 17.14.42 (per CVE record range)
• Visual Studio 2026 version 18.10 before build 18.10.4

Fixed in

• Microsoft.AspNetCore.Components.WebAssembly.Server 8.0.32, 9.0.21, 10.0.13 and 11.0.0-rc.2
• Visual Studio 2026 build 18.10.4
• Visual Studio 2022 17.14: build 17.14.42 per the CVE record range; not independently confirmed

Workaround

• No separate official workaround; upgrading is the fix.
• Ensure UseWebAssemblyDebugging is only called in the Development environment and is not reachable in production or from untrusted networks.
• Generic hardening, not Microsoft guidance: a Content Security Policy that restricts inline scripts can reduce the impact of remaining XSS.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• MSRC: Publicly disclosed No, Exploited No, Exploitability assessment Exploitation Less Likely.
• No public proof-of-concept found; the only public item is a static-analysis rule for detecting exposed debug middleware.
• EPSS values vary by source (below 1% to about 0.95%).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Inventory all projects using Microsoft.AspNetCore.Components.WebAssembly.Server, including transitive references.
• Upgrade to 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2 matching each project's line; update Visual Studio 2026 to 18.10.4 and install the latest Visual Studio 2022 17.14 update.
• Verify that the debug middleware is not active in production and that development hosts are not reachable from untrusted networks.
• Patch even with low direct exposure, as NuGet audit tools may flag the package regardless of the endpoint.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  codevalai/microsoft-security-advisory-cv

Research sources

• Microsoft Security Response Center: CVE-2026-96230 msrc.microsoft.com
• GitHub Security Advisory GHSA-qjpx-jqm5-h2c4 (via OSV) osv.dev
• Microsoft .NET announcement github.com
• NuGet package Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.9 www.nuget.org
• HeroDevs vulnerability directory entry www.herodevs.com
• Ubuntu security notice CVE-2026-96230 ubuntu.com
• Red Hat Bugzilla 2548804 bugzilla.redhat.com
• Mallory vulnerability analysis mallory.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:56.