CVE-2026-96230

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

A cross-site scripting vulnerability (CVE-2026-96230) has been identified in the ASP.NET Core Blazor WebAssembly debugging page. The unauthenticated /_framework/debug endpoint, served while a developer debugs a Blazor WebAssembly app, could write exception text and the request's url query value into the page without encoding them, allowing script from another origin to run in that page.

Per CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), the weakness is a product that does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page served to other users.

This issue affects developer machines running ASP.NET Core 6.0 Blazor WebAssembly apps that call UseWebAssemblyDebugging, which the project templates do only in the Development environment, including under dotnet watch, on Windows, Linux, and macOS. Exploitation requires the developer to interact with attacker-controlled content while the debugging endpoint is running. Production deployments that do not enable WebAssembly debugging are not affected. Microsoft's advisory lists Microsoft.AspNetCore.Components.WebAssembly.Server 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Details

Module Info

• Product: Any NES for .NET 6 Blazor WebAssembly project using Microsoft.AspNetCore.Components.WebAssembly.Server 6.0.46 or earlier with WebAssembly debugging enabled.
• Affected packages: Microsoft.AspNetCore.Components.WebAssembly.Server (package, not in the shared framework)
• Affected versions:
  
  • Microsoft.AspNetCore.Components.WebAssembly.Server >= 6.0.0 <= 6.0.46
• Package manager: NuGet
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Microsoft.AspNetCore.Components.WebAssembly.Server on NuGet
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the TargetPickerUi type of Microsoft.AspNetCore.Components.WebAssembly.Server, which renders the /_framework/debug page.

That page lists the browser tabs available for debugging so the developer can attach to the running app. When it cannot reach a debuggable browser, it shows an error page containing the exception it hit. Before the fix, the exception text was written into the HTML as is, while the rest of the page already HTML-encoded titles and URLs. The same error page also wrote the url query value from the request, unencoded, into its browser launch instructions. Text that reaches either value could therefore carry markup and script into a page served from the developer's local debugging endpoint.

The fix HTML-encodes the exception text, the url query value and the debugger tabs address with WebUtility.HtmlEncode everywhere the page writes them, in line with Microsoft's code for supported releases.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected projects to one of:
  
  • NES for .NET Microsoft.AspNetCore.Components.WebAssembly.Server 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Call UseWebAssemblyDebugging only in the Development environment, and avoid browsing untrusted sites in the same browser session while debugging until patched.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Kevin Gosse, as credited in Microsoft's advisory.