Description
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Microsoft .NET 10.0 installed on Linux
10.0.0 to < 10.0.403affected
Microsoft .NET 10.0 installed on Mac OS
10.0.0 to < 10.0.403affected
Microsoft .NET 10.0 installed on Windows
10.0.0 to < 10.0.403affected
Microsoft .NET 11.0 installed on Linux
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft .NET 11.0 installed on Mac OS
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft .NET 11.0 installed on Windows
11.0.0-preview.1 to < 11.0.100-rc.3affected
Microsoft Microsoft Visual Studio 2019 version 16.11
16.11.0 to < 16.11.61affected
Microsoft Microsoft Visual Studio 2022 version 17.14
17.14.0 to < 17.14.43affected
Microsoft Microsoft Visual Studio 2026 version 18.10
18.10.0 to < 18.10.4affected
Microsoft Microsoft Visual Studio 2026 version 18.11
18.11.0 to < 18.11.2affected
Microsoft Microsoft Visual Studio 2026 version 18.12
18.12.0 to < 18.12 Insiders 3affected
Microsoft Microsoft.AspNetCore.Components.WebAssembly.DevServer
11.0.0-preview.1 to < 10.0.14affected
Microsoft Microsoft.AspNetCore.Components.WebAssembly.Server
10.0.0 to < 10.0.13affected