undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Products covered
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 10.0 installed on Mac OS
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 11.0 installed on Mac OS
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Linux
Show 6 more products
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Mac OS
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 9.0 installed on Windows
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 9.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 9.0 installed on Mac OS
Microsoft Visual Studio 2026 version 18.10
Microsoft Visual Studio 2022 version 17.14
Remediation
Release Notes
Vendor-listed fixes
10.0.13
11.0.0-rc.2
8.0.32
9.0.21
18.10.4
17.14.42
CVEs in this advisory 1
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.