{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-96230/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:microsoft_aspnetcore_components_webassembly_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-96230"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft.AspNetCore.Components.WebAssembly.Server (\u003e= 8.0.0, \u003c= 8.0.31)","Microsoft.AspNetCore.Components.WebAssembly.Server (\u003e= 9.0.0, \u003c= 9.0.20)","Microsoft.AspNetCore.Components.WebAssembly.Server (\u003e= 10.0.0, \u003c= 10.0.12)","Microsoft.AspNetCore.Components.WebAssembly.Server (\u003e= 11.0.0-preview.1, \u003c= 11.0.0-rc.1)"],"_cs_severities":["high"],"_cs_tags":["xss","dot-net","web-application","cve-2026-96230"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eMicrosoft has disclosed a high-severity cross-site scripting (XSS) vulnerability, tracked as CVE-2026-96230, affecting the \u003ccode\u003eMicrosoft.AspNetCore.Components.WebAssembly.Server\u003c/code\u003e package. This vulnerability exists within the Blazor WebAssembly development server debug functionality. When the \u003ccode\u003edotnet watch\u003c/code\u003e command is utilized for development, the server exposes an unauthenticated \u003ccode\u003e/_framework/debug\u003c/code\u003e endpoint. This endpoint fails to properly encode exception text, allowing an attacker to reflect malicious scripts through the debug page.\u003c/p\u003e\n\u003cp\u003eThis issue is particularly relevant to environments where developers are actively using the \u003ccode\u003edotnet watch\u003c/code\u003e tooling. If exploited, an attacker could inject scripts into the session of a user viewing the development server interface. Organizations should identify projects utilizing the affected versions of \u003ccode\u003eMicrosoft.AspNetCore.Components.WebAssembly.Server\u003c/code\u003e across Windows, Linux, and macOS environments and update to the patched releases immediately.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability is categorized with a CVSS 3.1 score of 8.8 (High). Successful exploitation allows an attacker to execute arbitrary scripts in the context of the user's browser, potentially leading to unauthorized data access, session hijacking, or further client-side exploitation. This risk is localized to development environments where the \u003ccode\u003edotnet watch\u003c/code\u003e command is active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and update all .NET projects referencing the vulnerable \u003ccode\u003eMicrosoft.AspNetCore.Components.WebAssembly.Server\u003c/code\u003e package to the following versions:\u003c/li\u003e\n\u003cli\u003e8.0.32\u003c/li\u003e\n\u003cli\u003e9.0.21\u003c/li\u003e\n\u003cli\u003e10.0.13\u003c/li\u003e\n\u003cli\u003e11.0.0-rc.2\u003c/li\u003e\n\u003cli\u003eUpdate the .NET SDK and runtime by installing the latest versions available from Microsoft.\u003c/li\u003e\n\u003cli\u003eRecompile and redeploy any self-contained applications that were built using the affected versions of the package.\u003c/li\u003e\n\u003cli\u003eRestrict access to development-server endpoints in network environments, ensuring they are not exposed to untrusted users or external networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T00:30:49Z","date_published":"2026-10-14T00:30:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aspnet-core-xss/","summary":"An unencoded exception reflection vulnerability in the Blazor WebAssembly development server allows remote attackers to perform cross-site scripting (XSS) via the unauthenticated /_framework/debug endpoint.","title":"CVE-2026-96230 ASP.NET Core Cross-Site Scripting Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-aspnet-core-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-96230","version":"https://jsonfeed.org/version/1.1"}