Executive brief
Microsoft Visual Studio Code, a widely used code editor for software development, contains a security vulnerability that could allow an attacker to bypass built-in security protections. By tricking a user into interacting with malicious content, an attacker could potentially gain unauthorized access to sensitive information stored within the application. This could lead to the exposure of proprietary source code or developer credentials.
Technical details
A cross-site scripting (XSS) vulnerability exists in Microsoft Visual Studio Code due to improper neutralization of input during web page generation. The flaw is categorized under CWE-79 (XSS) and CWE-59 (Improper Link Resolution), suggesting the vulnerability may involve how the application handles links or rendered content in its web-based UI components. An attacker can exploit this locally by requiring a user to perform a specific action (User Interaction), leading to a scope change (Status: C) and the exposure of sensitive information (Confidentiality: High). Microsoft has addressed this issue in their security update guide.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory