UBUNTU-CVE-2026-102870: Code Injection
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet11to a version that resolves this vulnerability.Fixed in 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/dotnet10to a version that resolves this vulnerability.Fixed in 10.0.114-10.0.14-0ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which Ubuntu packages are identified as affected?
The affected software listed is ubuntu/dotnet7, ubuntu/dotnet10, and ubuntu/dotnet11.
Does exploitation require authentication or prior privileges?
No. The vector indicates network exploitation with low attack complexity and no privileges required, although user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation can allow unauthorized code execution and may result in high impact to confidentiality, integrity, and availability.