Dev Workstations at Risk: Microsoft Patches High-Severity Blazor Debugger Code Injection Flaw
A code injection flaw in the Blazor WebAssembly debugger allows remote code execution on developer workstations when expressions are evaluated.
Key points
- Microsoft rates CVE-2026-102870 as high severity with a CVSS score of 8.8
- Patches are available for affected versions of the WebAssembly.Server NuGet package
- The vulnerability impacts developers using Visual Studio 2022 and Visual Studio 2026
Microsoft has released patches for a code injection vulnerability in the Blazor WebAssembly debugger that could allow attackers to execute code on a developer’s machine. The flaw, tracked as CVE-2026-102870, affects the Microsoft.AspNetCore.Components.WebAssembly.Server NuGet package. According to the Microsoft Security Update Guide, improper control of code generation allows unauthorized attackers to execute code over a network.
How it unfolded
- Microsoft published an advisory detailing the code injection flaw in the Blazor debugger
- The NVD record assigns a CVSS score of 8.8 to the high-severity vulnerability
- GitHub advisories confirm patched versions are available for affected package releases
Who is affected
The vulnerability impacts projects using Microsoft.AspNetCore.Components.WebAssembly.Server versions 10.0.0 through 10.0.12, as well as preview versions from 11.0.0-preview.1 through 11.0.0-rc.1. According to the GitHub advisory, the issue affects Windows, Linux, and macOS systems across all architectures. Microsoft Visual Studio 2022 versions prior to 17.14.42 and Visual Studio 2026 versions prior to 18.10.4 are also listed as affected in the NVD record.
Our take on the response
Microsoft provided clear version boundaries for the fix, allowing teams to update specific NuGet packages rather than entire environments. The CVSS vector indicates user interaction is required, which limits the attack surface to active debugging sessions. That suggests the risk is concentrated on development workstations rather than production servers.
Who needs to act first
Teams should prioritize updating developer workstations that actively use the Blazor WebAssembly debugger. Check whether any engineering staff are using vulnerable versions of the WebAssembly.Server package. Roll out the update during a maintenance window or at the end of the workday to minimize disruption. Back up project configurations before applying the package update. Verify the fix by reviewing the package version in the project dependencies. Communicate the change to developers so they can restart their debugging sessions safely.
What to do and how to stay safe: CVE-2026-102870
- Audit NuGet packages in active development projects to identify vulnerable versions
- Update to Microsoft.AspNetCore.Components.WebAssembly.Server 10.0.13 or later
- Restart Visual Studio instances after applying the package update
- Monitor debugging sessions for unexpected behavior during the transition
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which packages are affected by CVE-2026-102870?
The Microsoft.AspNetCore.Components.WebAssembly.Server package versions 10.0.0 through 10.0.12 and 11.0.0-preview.1 through 11.0.0-rc.1 are affected.
Is there a fix available for this vulnerability?
Yes, Microsoft has released patched versions 10.0.13 and 11.0.0-rc.2.26478.115 for the affected packages.
What is the CVSS score for this flaw?
The NVD records a CVSS score of 8.8, classifying the severity as high.
