Executive brief
A security vulnerability has been identified in Microsoft Visual Studio Code, a widely used code editor for software development. An attacker could exploit this flaw to gain higher-level system permissions on a user's computer, potentially allowing them to view sensitive data or execute unauthorized commands. This typically requires a user to interact with a malicious file or environment provided by the attacker.
Technical details
A privilege escalation vulnerability exists in Microsoft Visual Studio Code due to the improper inclusion of functionality from an untrusted control sphere (CWE-829) and improper control of code generation (CWE-94). The vulnerability allows a local, unauthorized attacker to elevate their privileges on the host system. Exploitation requires user interaction, such as a user opening a specially crafted file or workspace. Successful exploitation grants the attacker high-level access (Confidentiality, Integrity, and Availability impact), effectively allowing for arbitrary code execution with the privileges of the user running the application. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-06-09: disclosed: Initial publication of the CVE record.
- 2026-06-09: advisory: Microsoft released an advisory and update guide.