Patch Blazor Debugger Now to Block Remote Code Execution on Dev Machines

Microsoft has released patches for a high-severity code injection vulnerability in the Blazor WebAssembly debugger included in the Microsoft.AspNetCore.Components.WebAssembly.Server package. The flaw, tracked as CVE-2026-102870, allows an unauthorized attacker to execute code on a developer's machine when the developer evaluates an expression during debugging.

The risk

The vulnerability stems from improper control of code generation within the debug proxy. According to the GitHub advisory GHSA-g27p-qf6j-c96c, the proxy generates and compiles C# source code to evaluate debugger expressions. Values from the application being debugged, such as class names or ToString results, are embedded in this source without consistent escaping. An attacker can control these values to escape the generated string literal and execute code on the machine where the developer is running the debugger.

Who is exposed

Developers using Microsoft Visual Studio 2022 version 17.14 before 17.14.42 or Visual Studio 2026 version 18.10 before 18.10.4 are exposed to this risk. The vulnerability also affects projects using the Microsoft.AspNetCore.Components.WebAssembly.Server NuGet package. Specifically, versions 10.0.0 through 10.0.12 and preview versions 11.0.0-preview.1 through 11.0.0-rc.1 are vulnerable. This issue impacts development environments on Windows, Linux, and macOS across all architectures.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 8.8 to CVE-2026-102870, classifying it as high severity. The weakness is categorized under CWE-94, improper control of generation of code. The CVSS vector indicates network accessibility, low complexity, no privileges required, and user interaction is required. This aligns with the mechanism where a developer must evaluate an expression during debugging for the code injection to occur on their workstation.

Our take on the response

Microsoft has provided patched versions of the affected components, allowing teams to remediate this risk immediately. The availability of updates for both Visual Studio and the specific NuGet package means that exposure can be reduced by upgrading development tools and project dependencies. This ensures that developers using the Blazor WebAssembly debugger are protected against this specific code injection vector.

What defenders should look for

Security operations teams should monitor developer workstations for unexpected process creation or outbound network connections originating from debugging tools. Investigate alerts for legitimate development software executing commands outside normal compilation workflows. Check logs for signs of dynamic code generation or compilation events triggered by user input rather than build scripts. If anomalies are detected, isolate the affected workstation from the network to prevent lateral movement while analyzing the executed code for malicious intent.

What to do and how to stay safe: Microsoft

• Update Microsoft Visual Studio 2022 to version 17.14.42 or later and Visual Studio 2026 to 18.10.4 or later.
• Replace vulnerable Microsoft.AspNetCore.Components.WebAssembly.Server packages with version 10.0.13 or 11.0.0-rc.2.26478.115 in affected projects.
• Audit development environments for other outdated NuGet packages that may contain unpatched code injection flaws.
• Educate developers on the risks of debugging untrusted applications, as user interaction is required to trigger this specific exploit.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does this vulnerability affect production servers?

This specific flaw affects the Blazor WebAssembly debugger used on developer workstations, not production server deployments.

Which operating systems are affected by CVE-2026-102870?

The vulnerability impacts development environments running on Windows, Linux, and macOS across all architectures.

Is a user interaction required to exploit this flaw?

Yes, the CVSS vector indicates user interaction is required, specifically when a developer evaluates an expression during debugging.