Summary
Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did
not properly validate cross-origin WebSocket connections. An attacker could
possibly use this issue to expose sensitive information. (CVE-2026-58649)
Rajesh Chada discovered that the .NET watch AspireServerService improperly
exposed information through the use of certain arguments. An attacker could
possibly use this issue to elevate privileges and execute arbitrary code.
(CVE-2026-69806)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | dotnet8 | 8.0.131-8.0.31-0ubuntu1~22.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet10 | 10.0.112-10.0.12-0ubuntu1~24.04.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | dotnet8 | 8.0.131-8.0.31-0ubuntu1~24.04.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | dotnet10 | 10.0.112-10.0.12-0ubuntu1~26.04.1 |
Vulnerabilities 2
-
High 7.0
.NET Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
.NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.