Junglewise Threat Intelligence

CVE-2026-41611: Microsoft Visual Studio Code XSS and local code execution

CVE-2026-41611 · Severity: high · CVSS 7.8 · Published 2026-05-12

Technologies: Microsoft Visual Studio Code. Vendors: Microsoft.

Executive brief

Microsoft Visual Studio Code, a widely used code editor, is vulnerable to a security flaw that could allow an attacker to run malicious code on a user's computer. This occurs when the application fails to properly clean web-based content, potentially leading to a full system compromise if a user interacts with a specially crafted file or link. Successful exploitation could result in the theft of sensitive data, unauthorized access to local files, or the installation of malware.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Microsoft Visual Studio Code due to improper neutralization of script-related HTML tags. The flaw (CWE-80 and CWE-77) allows an attacker to bypass security boundaries when the application renders malicious web content. While the attack vector is classified as local, it requires user interaction, such as opening a malicious file or clicking a link. If exploited, the attacker can achieve local code execution with the privileges of the current user, leading to a complete loss of confidentiality, integrity, and availability. Microsoft has addressed this issue in their security update guide.

Affected products

  • Microsoft Visual Studio Code

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References

Related threats