Executive brief
A security vulnerability exists in Visual Studio Code, a popular code editor used by developers to write and manage software. An attacker could exploit this flaw to gain unauthorized access to sensitive files stored on a user's local computer. This could lead to the exposure of private source code, configuration files, or other personal data if a user is tricked into interacting with a malicious file or workspace.
Technical details
A relative path traversal vulnerability (CWE-23/CWE-22) exists in Microsoft Visual Studio Code. The flaw allows an attacker to bypass directory restrictions and access files outside of the intended scope. The attack vector is local, requiring user interaction (UI:R), such as opening a specially crafted file or workspace. Successful exploitation results in high confidentiality impact (C:H) by allowing the disclosure of local information to the attacker. The vulnerability was disclosed by Microsoft with a CVSS 3.1 base score of 5.5.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-05-12: disclosed: Initial disclosure by Microsoft and NVD publication.