{"id":"CVE-2026-102870","published":"2026-10-13T19:17:51.617","lastModified":"2026-10-14T04:18:08.113","description":"Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102870","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a code injection vulnerability in ASP.NET Core that allows remote attackers to execute arbitrary code on affected systems. The flaw occurs when the application improperly handles code generation, creating opportunities for attackers to inject malicious code that gets executed over the network.","exploitability":"Exploitation is moderately difficult as it requires crafting specific input that triggers the code generation process, but once triggered, attackers can execute arbitrary code with the privileges of the affected application.","blast_radius":"The impact could be significant across web applications using ASP.NET Core, potentially allowing attackers to compromise entire web servers and access sensitive data or perform unauthorized operations.","remediation":"Upgrade to ASP.NET Core 8.0.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","dotnet"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:53:22.373Z"}}