Executive brief
Microsoft Visual Studio Code, a widely used code editor for software development, is affected by a security flaw that could allow an attacker to modify files. By tricking a user into interacting with a malicious link or file, an unauthorized attacker can remotely tamper with the application's data. This could lead to unauthorized changes in code or configuration, potentially compromising the integrity of development projects.
Technical details
A relative path traversal vulnerability (CWE-23) exists in Microsoft Visual Studio Code. The flaw allows an unauthenticated attacker to perform file tampering over a network by exploiting improper validation of file paths. While the attack vector is network-based, the CVSS vector indicates that user interaction is required (UI:R) to successfully execute the exploit. Successful exploitation grants the attacker the ability to modify files (Integrity: High) but does not directly provide confidentiality or availability impacts according to the reported metrics. Microsoft has released information regarding this vulnerability via their Security Update Guide.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: MSRC advisory published