{"id":"CVE-2026-96230","published":"2026-10-13T19:21:48.720","lastModified":"2026-10-13T20:19:14.367","description":"Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96230","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a cross-site scripting vulnerability in ASP.NET Core that allows remote attackers to inject malicious scripts into web pages, potentially leading to unauthorized code execution. The flaw occurs during web page generation when input is not properly neutralized.","exploitability":"Exploitation is relatively straightforward as it requires only a network-based attack with no authentication needed, though the attacker must be able to inject data into a vulnerable web page context.","blast_radius":"If exploited, this vulnerability could impact all users of affected ASP.NET Core applications, potentially allowing attackers to hijack user sessions, steal sensitive data, or execute arbitrary commands on the server.","remediation":"Upgrade to ASP.NET Core 8.0.1 or later to remediate this XSS vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["xss","web","dotnet","rce"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:18:11.935Z"}}