Executive brief
Visual Studio Code, a widely used code editor, contains a security flaw that could allow an attacker to bypass built-in security protections. By tricking a user into interacting with a malicious file or workspace, an attacker could gain unauthorized access to sensitive information on the user's computer. This could lead to the theft of source code, credentials, or other private data stored on the local system.
Technical details
A path traversal vulnerability (CWE-22) exists in Microsoft Visual Studio Code versions prior to 1.128.1. The flaw stems from improper limitation of pathnames to restricted directories, which can be exploited by an unauthorized attacker to bypass local security features. Exploitation requires local access and user interaction, typically involving a user opening a specially crafted file or workspace. Successful exploitation allows the attacker to read sensitive information from the local file system (Confidentiality: High), though it does not provide a direct path for data modification or service disruption. Microsoft has addressed this in the latest updates for Visual Studio Code.
Affected products
- Microsoft Corporation Visual Studio Code 1.0.0 to 1.128.1
Timeline
- 2026-07-14: advisory: Microsoft published the security advisory.
- 2026-07-14: disclosed: CVE record published to the NVD dataset.