CVE-2026-96230

Summary

This CVE describes a cross-site scripting vulnerability in ASP.NET Core that allows remote attackers to inject malicious scripts into web pages, potentially leading to unauthorized code execution. The flaw occurs during web page generation when input is not properly neutralized.

Exploitability

Exploitation is relatively straightforward as it requires only a network-based attack with no authentication needed, though the attacker must be able to inject data into a vulnerable web page context.

Blast radius

If exploited, this vulnerability could impact all users of affected ASP.NET Core applications, potentially allowing attackers to hijack user sessions, steal sensitive data, or execute arbitrary commands on the server.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to ASP.NET Core 8.0.1 or later to remediate this XSS vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.