This vulnerability arises from improper neutralization of input during web page generation, leading to a cross‑site scripting flaw that permits an attacker to execute arbitrary code over a network. The flaw effectively turns any supplied input that contains executable script into part of the rendered page, allowing the attacker to run scripts in the context of the application or affected user.

The flaw affects Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, and Microsoft.AspNetCore.Components.WebAssembly.Server. These products are used to build and host ASP.NET Core applications that run on the web. Attacked systems are those that deploy any of these versions without applying the latest security updates.

The CVSS score is 8.8, indicating high severity. EPSS is not available; however, the lack of evidence for a currently deployed exploit does not diminish the impact of the flaw, as it can be triggered with a crafted HTTP request. The vulnerability is not listed in the CISA KEV catalog. Attackers can execute code without authentication by supplying malicious script data that bypasses output encoding, making the vulnerability exploitable remotely over the network.