CVE-2026-102870: CWE-94: Improper Control of Generation of Code ('Code Injection') in Microsoft Microsoft Visual Studio 2022 version 17.14

The vulnerability exists in the Blazor WebAssembly debug proxy, which evaluates debugger expressions by generating and compiling C# source code. Certain application-originated values such as ToString() results, descriptions, and class names are embedded in this generated source without consistent escaping. This improper control of code generation (CWE-94) allows an attacker to inject code that executes on the developer's machine during debugging when an expression involving attacker-controlled data is evaluated. The issue affects Microsoft.AspNetCore.Components.WebAssembly.Server package versions >=10.0.0 and <=10.0.12, as well as preview versions >=11.0.0-preview.1 and <=11.0.0-rc.1. Patched versions 10.0.13 and 11.0.0-rc.2.26478.115 have been released. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity.

Successful exploitation can lead to remote code execution on the developer's machine during debugging sessions involving attacker-controlled application data. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability affects all platforms (Windows, Linux, macOS) and architectures where the vulnerable package is used.

An official fix is available. Users should update Microsoft.AspNetCore.Components.WebAssembly.Server to version 10.0.13 or later (for the 10.x release) or 11.0.0-rc.2.26478.115 or later (for the 11.x preview release). After updating, restart the debugger and development environment. Installing the latest supported .NET version is also recommended. No additional mitigations are indicated by the vendor advisory.