Advisories for Nuget/Microsoft.AspNetCore.Components.WebAssembly.Server package

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly development-server debug page can reflect unencoded exception text, allowing cross-origin script injection through the unauthenticated /_framework/debug endpoint used by dotnet watch.

Microsoft is releasing this security advisory to provide information about a vulnerability in the Blazor WebAssembly debugger included in Microsoft.AspNetCore.Components.WebAssembly.Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The Blazor WebAssembly debug proxy evaluates debugger expressions by generating and compiling C# source. Certain values originating in the application being debugged, including ToString() results, descriptions, and class names, are embedded in …