https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 17:44:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102870 <p>Improper control of generation of code (&#39;code injection&#39;) in ASP.NET Core allows an unauthorized attacker to execute code over a network.</p> <p>Improper control of generation of code (&#39;code injection&#39;) in ASP.NET Core allows an unauthorized attacker to execute code over a network.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102870 https://db.gcve.eu/vuln/ghsa-g27p-qf6j-c96c <p><strong>Affected:</strong> NuGet: Microsoft.AspNetCore.Components.WebAssembly.Server</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.</p> <p>The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including `ToString()` results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer&#39;s machine when the developer evaluates an expression during debugging.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/445</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 8.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - **Weakness:** CWE-94 (Improper Control of Generation of Code (&#39;Code Injection&#39;))</p> <p>## Affected Platforms</p> <p>- **Platforms:** Windows, Linux, macOS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The vulnerability affects Microsoft .NET projects that use an affected package version listed below.</p> <p>Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNe…</p> <p><strong>Affected:</strong> NuGet: Microsoft.AspNetCore.Components.WebAssembly.Server</p> <p>## Executive summary</p> <p>Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in `Microsoft.AspNetCore.Components.WebAssembly.Server`. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.</p> <p>The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including `ToString()` results, descriptions, and class names, are embedded in that generated source without consistent escaping. An attacker-controlled value can escape the generated string literal and execute code on a developer&#39;s machine when the developer evaluates an expression during debugging.</p> <p>## Announcement</p> <p>Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/445</p> <p>## CVSS Details</p> <p>- **Version:** 3.1 - **Severity:** High - **Score:** 8.8 - **Vector:** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - **Weakness:** CWE-94 (Improper Control of Generation of Code (&#39;Code Injection&#39;))</p> <p>## Affected Platforms</p> <p>- **Platforms:** Windows, Linux, macOS - **Architectures:** All</p> <p>## &lt;a name=&#34;affected-packages&#34;&gt;&lt;/a&gt;Affected Packages</p> <p>The vulnerability affects Microsoft .NET projects that use an affected package version listed below.</p> <p>Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNe…</p> https://db.gcve.eu/vuln/ghsa-g27p-qf6j-c96c https://db.gcve.eu/vuln/ncsc-2026-0426 NCSC-2026-0426 https://db.gcve.eu/vuln/ncsc-2026-0426