Executive brief
A security vulnerability in Microsoft Visual Studio Code could allow an unauthorized attacker to gain elevated permissions on a user's system. Visual Studio Code is a widely used code editor for software development; an exploit could allow an attacker to hijack a user's session and perform actions as that user. This could lead to the theft of sensitive source code, credentials, or full system compromise depending on the user's local permissions.
Technical details
A session fixation vulnerability exists in Microsoft Visual Studio Code. The flaw allows a remote, unauthenticated attacker to fixate a user's session identifier, leading to privilege escalation if the victim interacts with the attacker's malicious link or session. According to the vendor, the vulnerability is tracked as both CWE-384 (Session Fixation) and CWE-78 (OS Command Injection), suggesting that the session hijacking may lead to arbitrary command execution. The attack requires user interaction (UI:R) but can be initiated over the network with low complexity. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory