Does CVE-2026-96230 Expose Blazor Dev Servers to Cross-Site Scripting?

Microsoft has released patches for a high-severity vulnerability in ASP.NET Core. The flaw resides in the Blazor WebAssembly development server component. It allows unauthorized attackers to execute code over a network by exploiting cross-site scripting weaknesses. This issue impacts projects using .NET versions 8 through 11 that include the affected package.

Root cause

The vulnerability stems from improper neutralization of input during web page generation. The Blazor WebAssembly development-server debug page can reflect unencoded exception text. This behavior allows cross-origin script injection through the endpoint. The issue is classified as CWE-79, indicating a failure to properly sanitize data before rendering it in a browser context.

Attack path

An attacker targets the unauthenticated `/_framework/debug` endpoint. This endpoint is used by the `dotnet watch` command during development. By sending crafted requests, the attacker can trigger exceptions that reflect malicious scripts. The CVSS score is 8.8, rated high, with a vector requiring user interaction but no prior authentication or privileges.

Affected versions

• Microsoft.AspNetCore.Components.WebAssembly.Server 8.0.0 through 8.0.31 is patched in 8.0.32.
• Versions 9.0.0 through 9.0.20 are patched in 9.0.21.
• Versions 10.0.0 through 10.0.12 are patched in 10.0.13.
• Preview versions 11.0.0-preview.1 through 11.0.0-rc.1 are patched in 11.0.0-rc.2.

Mitigation

• Update Microsoft.AspNetCore.Components.WebAssembly.Server to the latest patched version.
• Ensure all development environments apply the security update immediately.
• Verify that the `/_framework/debug` endpoint is not exposed to untrusted networks.
• Review application logs for signs of unauthorized script injection attempts.

What it means for organisations

Teams should verify that development servers are isolated from production networks. Security leads must confirm that all build pipelines use patched package versions. Developers need to be reminded not to expose debug endpoints in staging environments. IT operations should audit access controls to ensure only authorized personnel can interact with development interfaces. This reduces the risk of accidental exposure during routine testing.

What to do and how to stay safe: Microsoft

• Check your project dependencies for vulnerable versions of the WebAssembly.Server package.
• Apply the available patches to all affected .NET projects.
• Restrict access to the debug endpoint to internal development networks only.
• Monitor server logs for unusual activity or script injection patterns.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-96230?

It is a high-severity cross-site scripting vulnerability in ASP.NET Core that allows remote code execution via the Blazor debug endpoint.

Which .NET versions are affected?

Versions 8, 9, 10, and 11 of Microsoft.AspNetCore.Components.WebAssembly.Server are affected, with specific patched versions available for each.

Is there a patch available?

Yes, Microsoft has released patched versions for all affected packages, including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.