Executive brief
A security vulnerability in Visual Studio Code could allow an attacker to bypass built-in security protections. Visual Studio Code is a widely used code editor for software development; an exploit could allow an attacker to gain unauthorized access to sensitive information on a developer's machine. This typically requires a user to interact with a malicious file or workspace provided by the attacker.
Technical details
A security feature bypass vulnerability exists in Microsoft Visual Studio Code due to improper input validation and relative path traversal (CWE-20, CWE-23). An unauthenticated local attacker can exploit this flaw by convincing a user to open a specially crafted file or workspace. Successful exploitation allows the attacker to bypass security boundaries, potentially leading to high confidentiality impact and limited integrity impact. The vulnerability is tracked as CVE-2026-48569 and carries a CVSS 3.1 score of 7.1, noting that user interaction is required and the scope is changed.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-06-09: disclosed: Initial publication by Microsoft and NVD.
- 2026-06-09: advisory