CVE-2026-96230

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

This vulnerability is rated as an Important severity flaw because an attacker can achieve code execution within the context of the user's session if a developer is tricked into interacting with malicious web content while running the Blazor development server. The flaw specifically resides in the unauthenticated debug endpoint used during hot reload and development workflows, meaning standard production deployments are not directly exposed. Consequently, the risk is primarily constrained to active development environments where the interactive debugging tooling is actively executing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.