CVE-2026-102870

Timing: Microsoft first disclosed this flaw on 13 October 2026. It re-released the fix on 25 October 2026, because the first one was incomplete.

CVE-2026-102870 is a code injection flaw in the Blazor WebAssembly debugger. The debugger ships in two Microsoft.AspNetCore NuGet packages: Components.WebAssembly.Server and Components.WebAssembly.DevServer. The full names are in the version fields.

Microsoft explains the cause. To evaluate a debugger expression, the debug proxy generates and compiles C# source. Some values from the debugged app go into that source without consistent escaping. Microsoft names ToString() results, descriptions and class names.

A hostile value can escape the generated string literal. Code then runs on the developer's machine when they evaluate an expression during a debug session. It runs in the developer's context.

Microsoft scores it CVSS 3.1 8.8 (High) and rates it Important. The full vector is in the CVSS field. User interaction is required. NVD shows the Microsoft score only and is still analysing the entry.

What the 13 October fix missed. The first advisory listed only the Server package, fixed in 10.0.13 and 11.0 RC2. On 25 October Microsoft revised it to "corrected .NET 10 and .NET 11 debugger packages and versions". The DevServer package is now listed too. Microsoft does not describe the code change.

Fixed versions: both packages 10.0.14 for .NET 10, and 11.0.0-rc.3.26522.148 for .NET 11. Versions 10.0.13 and 11.0 RC2 are still affected. .NET 8 and 9 are not listed.

Microsoft is explicit: updating only the shared runtime does not fix this. You must update the package references, then restart the debugger and your development environment.

Some databases still show the 13 October versions. The global GitHub Advisory Database entry lists 10.0.13 as fixed and omits DevServer. Use Microsoft's revised advisory.

Microsoft credits alittleston3. MSRC says the flaw was not publicly disclosed or exploited, and rates exploitation "less likely". It is not in CISA KEV (catalog 2026.10.23, checked 26 October). ThreatWire found no public proof of concept.

Read the full .NET out-of-band explainer.