Описание
ASP.NET Core Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
FAQ
How could an attacker exploit this vulnerability?
An unauthenticated attacker could supply specially crafted data to an application being debugged. If a developer evaluates an affected object during a Blazor WebAssembly debugging session, successful exploitation could allow the attacker to execute code in the developer's context. User interaction is required.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Visual Studio 2022 version 17.14 | ||
| Microsoft Visual Studio 2026 version 18.10 | ||
| Microsoft.AspNetCore.Components.WebAssembly.Server | ||
| .NET 10.0 installed on Windows | ||
| .NET 10.0 installed on Linux | ||
| .NET 10.0 installed on Mac OS | ||
| .NET 11.0 installed on Windows | ||
| .NET 11.0 installed on Linux | ||
| .NET 11.0 installed on Mac OS | ||
| Microsoft Visual Studio 2019 version 16.11 |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
8.8 High
CVSS3
Связанные уязвимости
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability
EPSS
8.8 High
CVSS3