CVSS 8.8 Blazor Debug Flaw Lets Attackers Run Code on Dev PCs; Microsoft Patches VS 2022

An attacker can execute unauthorized code on a developer’s computer by exploiting a flaw in the Blazor WebAssembly debugger, according to Microsoft’s security advisory. The vulnerability, identified as CVE-2026-102870, allows remote code execution when a developer evaluates expressions during a debugging session. This means that simply interacting with the debugger interface can trigger malicious actions on the host machine.

The risk

The National Vulnerability Database assigns a CVSS score of 8.8 to this issue, classifying it as high severity. The weakness stems from improper control of code generation, known as code injection. The Blazor WebAssembly debug proxy creates and compiles C# source code to evaluate debugger expressions. According to the GitHub advisory, certain values from the application being debugged are embedded in that generated source without consistent escaping.

An attacker-controlled value can escape the generated string literal. When a developer evaluates an expression, the unescaped code executes on their machine. The vulnerability affects Windows, Linux, and macOS systems across all architectures. The Common Weakness Enumeration identifies this as CWE-94, improper control of generation of code.

Who is exposed

Developers using specific versions of Microsoft Visual Studio are affected. Visual Studio 2022 versions before 17.14.42 are vulnerable, as are Visual Studio 2026 versions before 18.10.4. The flaw also impacts projects using the `Microsoft.AspNetCore.Components.WebAssembly.Server` NuGet package. Versions 10.0.0 through 10.0.12 are vulnerable, as are preview versions 11.0.0-preview.1 through 11.0.0-rc.1.

Cost and compliance

The source material does not detail financial costs or specific compliance implications for this vulnerability. Organizations should assess their internal security policies regarding remote code execution risks on development workstations. Reviewing incident response plans for compromised developer machines may be prudent.

What should you do?

Teams should verify if they use affected versions of Visual Studio or the WebAssembly server package. Developers should update to the patched versions immediately to mitigate the risk. Monitoring for unusual activity on development machines during debugging sessions is also recommended.

The background in plain language

Debugging tools allow developers to pause code execution and inspect variables. This process often involves generating temporary code to display values. If that generated code is not properly sanitized, it can include malicious instructions. Teams usually rely on these tools for daily development tasks, making them high-value targets. Check whether your debugging environment processes untrusted data. Ensure that any code generation features are isolated from the host system. Regular updates to development tools are essential for maintaining security.

Background: Remote code execution vulnerabilities

Small businesses face high remote code execution risks due to limited patching resources and complex dependencies. You can mitigate this by enforcing strict input validation, maintaining an accurate IT asset inventory, and requiring vendors to demonstrate automated security regression testing for all updates.

Read the full guide: Remote Code Execution Risks and Protection for Small Businesses

What to do and how to stay safe: Microsoft

• Audit your development environment for affected versions of Visual Studio and the WebAssembly server package
• Update to the latest patched versions provided by Microsoft to close the vulnerability
• Monitor developer workstations for unexpected code execution or network connections during debugging
• Educate developers about the risks of evaluating expressions in potentially compromised applications

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102870?

The National Vulnerability Database rates CVE-2026-102870 as 8.8, which is a high severity score.

Which Visual Studio versions are vulnerable?

Visual Studio 2022 versions before 17.14.42 and Visual Studio 2026 versions before 18.10.4 are affected.

Is there a fix available for the NuGet package?

Yes, Microsoft provides patched versions 10.0.13 and 11.0.0-rc.2.26478.115 for the affected packages.