Executive brief
Microsoft Visual Studio Code, a widely used code editor, is vulnerable to a security flaw that could allow an attacker to run malicious code on a user's computer. This occurs when the application fails to properly clean web-based content, potentially leading to a full system compromise if a user interacts with a specially crafted file or link. Successful exploitation could result in the theft of sensitive data, unauthorized access to local files, or the installation of malware.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Microsoft Visual Studio Code due to improper neutralization of script-related HTML tags. The flaw (CWE-80 and CWE-77) allows an attacker to bypass security boundaries when the application renders malicious web content. While the attack vector is classified as local, it requires user interaction, such as opening a malicious file or clicking a link. If exploited, the attacker can achieve local code execution with the privileges of the current user, leading to a complete loss of confidentiality, integrity, and availability. Microsoft has addressed this issue in their security update guide.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory