Read the docs
TI-2026-73019 Aliases CVE-2026-96230GHSA-qjpx-jqm5-h2c4

Cross-site scripting in ASP.NET Core allows remote code execution

Priority MEDIUM 42CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Microsoft ASP.NET Core is affected, including Visual Studio 2022 version 17.14, Visual Studio 2026 version 18.10 and the NuGet package Microsoft.AspNetCore.Components.WebAssembly.Server. Input is not neutralized during web page generation, a cross-site scripting flaw (CWE-79). An unauthorized attacker over a network can execute code, and user interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00946 61st percentileScored 2026-11-07
Fix Fixed Microsoft Visual Studio 2022 version 17.14 (Microsoft): 17.14.42Microsoft Visual Studio 2026 version 18.10 (Microsoft): 18.10.4+2 more productsRed Hat: 14 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 to before 17.14.4217.14.42Patch availableCNA
MicrosoftMicrosoft Visual Studio 2026 version 18.1018.10.0 to before 18.10.418.10.4Patch availableCNA
MicrosoftMicrosoft.AspNetCore.Components.WebAssembly.Server10.0.0 to before 10.0.1310.0.13Patch availableCNA
—Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet)10.0.0 to before 10.0.1310.0.13Patch availableGHSA-qjpx-jqm5-h2c4
—Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet)11.0.0-preview.1 to before 11.0.0-rc.211.0.0-rc.2Patch availableGHSA-qjpx-jqm5-h2c4
—Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet)8.0.0 to before 8.0.328.0.32Patch availableGHSA-qjpx-jqm5-h2c4
—Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet)9.0.0 to before 9.0.219.0.21Patch availableGHSA-qjpx-jqm5-h2c4
  • Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.42 Fixed in 17.14.42 Patch available CNA
  • Microsoft Visual Studio 2026 version 18.10 VendorMicrosoft Affected 18.10.0 to before 18.10.4 Fixed in 18.10.4 Patch available CNA
  • Microsoft.AspNetCore.Components.WebAssembly.Server VendorMicrosoft Affected 10.0.0 to before 10.0.13 Fixed in 10.0.13 Patch available CNA
  • Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Vendor— Affected 10.0.0 to before 10.0.13 Fixed in 10.0.13 Patch available GHSA-qjpx-jqm5-h2c4
  • Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Vendor— Affected 11.0.0-preview.1 to before 11.0.0-rc.2 Fixed in 11.0.0-rc.2 Patch available GHSA-qjpx-jqm5-h2c4
  • Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Vendor— Affected 8.0.0 to before 8.0.32 Fixed in 8.0.32 Patch available GHSA-qjpx-jqm5-h2c4
  • Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Vendor— Affected 9.0.0 to before 9.0.21 Fixed in 9.0.21 Patch available GHSA-qjpx-jqm5-h2c4

Remediation

Update Visual Studio 2022 version 17.14 to 17.14.42, Visual Studio 2026 version 18.10 to 18.10.4, and Microsoft.AspNetCore.Components.WebAssembly.Server to 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2. Red Hat advisories fixing it are RHSA-2026:86168, RHSA-2026:86169, RHSA-2026:86170, RHSA-2026:86171, RHSA-2026:86172, RHSA-2026:86192, RHSA-2026:86193, RHSA-2026:86195, RHSA-2026:86594, RHSA-2026:88422, RHSA-2026:88424, RHSA-2026:88425, RHSA-2026:88474 and RHSA-2026:89735.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Microsoft Visual Studio 2022 version 17.14 (Microsoft) Fixed in 17.14.42
  • Fix · CNA Microsoft Visual Studio 2026 version 18.10 (Microsoft) Fixed in 18.10.4
  • Fix · CNA Microsoft.AspNetCore.Components.WebAssembly.Server (Microsoft) Fixed in 10.0.13
  • Fix · GHSA-qjpx-jqm5-h2c4 Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Fixed in 10.0.13 Advisory →
  • Fix · GHSA-qjpx-jqm5-h2c4 Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Fixed in 11.0.0-rc.2 Advisory →
  • Fix · GHSA-qjpx-jqm5-h2c4 Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Fixed in 8.0.32 Advisory →
  • Fix · GHSA-qjpx-jqm5-h2c4 Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Fixed in 9.0.21 Advisory →

Red Hat 14 advisories

  • RHSA-2026:89735 Released 2026-10-27 · Red Hat rating Critical
    .NET 9.0 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-9.0-9.0.21-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.21-1.el9_6 +12
  • RHSA-2026:88474 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.32-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_0 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_0
  • RHSA-2026:88422 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_6
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.32-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_6 +9
Show 11 more Red Hat advisories
  • RHSA-2026:88425 Released 2026-10-22 · Red Hat rating Critical
    .NET 8.0 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) aspnetcore-runtime-8.0-8.0.32-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_4 +11
  • RHSA-2026:88424 Released 2026-10-22 · Red Hat rating Critical
    .NET 9.0 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-9.0-9.0.21-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.21-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_0
  • RHSA-2026:86594 Released 2026-10-21 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.32-2.el8_10, aspnetcore-runtime-dbg-8.0-8.0.32-2.el8_10, aspnetcore-targeting-pack-8.0-8.0.32-2.el8_10 +9
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.132-2.el8_10
  • RHSA-2026:86193 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-10.0-10.0.13-1.el9_8, aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8, aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8
  • RHSA-2026:86171 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.21-1.el9_8, aspnetcore-runtime-dbg-9.0-9.0.21-1.el9_8, aspnetcore-targeting-pack-9.0-9.0.21-1.el9_8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el9_8
  • RHSA-2026:86169 Released 2026-10-20 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.32-1.el9_8, aspnetcore-runtime-dbg-8.0-8.0.32-1.el9_8, aspnetcore-targeting-pack-8.0-8.0.32-1.el9_8 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el9_8
  • RHSA-2026:86192 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-10.0-10.0.13-1.el8_10, aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10, aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10 +11
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10
  • RHSA-2026:86170 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.21-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.21-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.21-1.el8_10 +11
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el8_10
  • RHSA-2026:86172 Released 2026-10-20 · Red Hat rating Critical
    .NET 9.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.21-1.el10_2, aspnetcore-runtime-dbg-9.0-9.0.21-1.el10_2, aspnetcore-targeting-pack-9.0-9.0.21-1.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.122-1.el10_2
  • RHSA-2026:86195 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-10.0-10.0.13-1.el10_2, aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2, aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2
  • RHSA-2026:86168 Released 2026-10-20 · Red Hat rating Critical
    .NET 8.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.32-1.el10_2, aspnetcore-runtime-dbg-8.0-8.0.32-1.el10_2, aspnetcore-targeting-pack-8.0-8.0.32-1.el10_2 +9
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.132-1.el10_2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:88422, RHSA-2026:89735
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86168, RHSA-2026:86172, RHSA-2026:86195
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86170, RHSA-2026:86192, RHSA-2026:86594
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86169, RHSA-2026:86171, RHSA-2026:86193
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:88425
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:88424, RHSA-2026:88474
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:88422, RHSA-2026:89735
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:86170, RHSA-2026:86192, RHSA-2026:86594
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:86168, RHSA-2026:86172, RHSA-2026:86195
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:86169, RHSA-2026:86171, RHSA-2026:86193
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:88424, RHSA-2026:88474
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-96230
  2. 2026-10-13 Alias added: GHSA-qjpx-jqm5-h2c4
  3. 2026-10-13 Fix available: NuGet/[email protected], NuGet/[email protected], NuGet/[email protected] +1 · GHSA-qjpx-jqm5-h2c4
  4. 2026-10-13 CVSS score added · GHSA-qjpx-jqm5-h2c4
  5. 2026-10-13 Weakness changed · GHSA-qjpx-jqm5-h2c4
  6. 2026-10-13 4 new references · GHSA-qjpx-jqm5-h2c4
  7. 2026-10-14 Priority changed: LOW → MEDIUM
  8. 2026-10-20 2 new references · GHSA-qjpx-jqm5-h2c4
  9. 2026-10-20 Affected versions changed · Red Hat
  10. 2026-10-20 CVSS score added · Red Hat
  11. 2026-10-21 Fix available: RHSA-2026:86168 · Red Hat
  12. 2026-10-21 Fix available: RHSA-2026:86169 · Red Hat
  13. 2026-10-21 Fix available: RHSA-2026:86170 · Red Hat
  14. 2026-10-21 Fix available: RHSA-2026:86171 · Red Hat
  15. 2026-10-21 Fix available: RHSA-2026:86192 · Red Hat
  16. 2026-10-21 Fix available: RHSA-2026:86193 · Red Hat
  17. 2026-10-21 Fix available: RHSA-2026:86172 · Red Hat
  18. 2026-10-21 Fix available: RHSA-2026:86195 · Red Hat
  19. 2026-10-21 Fix available: RHSA-2026:86594 · Red Hat
  20. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +3 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88422 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:88424 · Red Hat
  23. 2026-10-23 Fix available: RHSA-2026:88474 · Red Hat
  24. 2026-10-23 Fix available: RHSA-2026:88425 · Red Hat
  25. 2026-10-23 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux AppStream EUS (v. 10.0) +2 · Red Hat
  26. 2026-10-29 Affected versions changed · Red Hat
  27. 2026-10-29 Fix available: RHSA-2026:89735 · Red Hat

References

Patch 1

Advisory 1

Other 4

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences