CVE-2026-96230 in ASP.NET Core
Summary
by MITRE • 10/14/2026
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described constitutes a classic Cross-Site Scripting (XSS) flaw within the ASP.NET Core framework, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. This security defect arises when an application fails to properly sanitize or encode user-supplied input before including it in dynamically generated HTML content. In a typical web interaction, data flows from the client to the server and is subsequently processed by ASP.NET Core to render responses. If this process does not adequately escape special characters such as angle brackets, ampersands, quotes, or other delimiters that hold specific meaning in HTML and JavaScript contexts, malicious scripts embedded within that input can be injected into the page structure. When a victim user loads the affected web page, their browser interprets these injected strings as executable code rather than inert data, leading to the unintended execution of arbitrary client-side script.
The operational impact of this vulnerability is severe because it allows an unauthorized attacker to execute code within the security context of the application's domain. This effectively bypasses same-origin policies that are designed to restrict how documents or scripts loaded from one origin interact with resources from another. By executing malicious JavaScript, an attacker can perform a variety of harmful actions including stealing sensitive session cookies and authentication tokens, hijacking user sessions, performing unauthorized actions on behalf of the victim such as fund transfers or data modification, defacing the website interface to damage reputation, or redirecting users to phishing sites designed to harvest credentials. The persistence of this threat depends heavily on whether the injected script is stored in a database for later retrieval (Stored XSS) or executed immediately upon page load without being saved (Reflected XSS), with Stored variants posing a significantly higher risk due to their ability to affect multiple victims over time.
From an offensive security perspective, this vulnerability aligns closely with MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter::JavaScript, which describes the use of JavaScript for executing commands or performing actions within a web browser environment. It also relates to T1189: Drive-by Client Side Execution, where exploitation occurs without user interaction beyond visiting the compromised page. The root cause is fundamentally an input validation failure where the application treats untrusted data as executable code rather than safe text content. This misclassification of data types allows the attacker's payload to bypass standard rendering filters and inject active elements into the Document Object Model (DOM).
Mitigation strategies must focus on robust output encoding and strict input validation. Developers should ensure that all user-supplied data is encoded according to its context within the HTML document, such as using HTML entity encoding for general text content or JavaScript string escaping when injecting data into script blocks. ASP.NET Core provides built-in mechanisms like the HtmlEncoder class which can be utilized explicitly during view generation to neutralize dangerous characters. Additionally, implementing Content Security Policy (CSP) headers serves as a critical defense-in-depth measure by restricting the sources from which scripts can be loaded and executed, thereby mitigating the impact even if an injection attempt succeeds. Regular security testing using static application security testing tools and dynamic analysis should also be employed to identify instances where input sanitization is missing or insufficiently implemented across all user-facing endpoints.