Executive brief
A security vulnerability exists in Microsoft Visual Studio Code, a widely used code editor for software development. An attacker could use this flaw to bypass built-in security protections by tricking a user into interacting with malicious content within the editor. If successful, this could allow the attacker to gain unauthorized access to sensitive information or perform actions on the user's behalf on their local machine.
Technical details
A cross-site scripting (XSS) vulnerability (CWE-79) exists in Microsoft Visual Studio Code due to improper neutralization of input during web page generation. The vulnerability is locally exploitable but requires user interaction, such as opening a malicious file or clicking a crafted link within the application. An attacker can leverage this to bypass local security features, potentially leading to high impacts on confidentiality and integrity. Microsoft has addressed this in version 1.128.1.
Affected products
- Microsoft Visual Studio Code >= 1.0.0, < 1.128.1
Timeline
- 2026-07-14: advisory: Initial advisory published by Microsoft and NVD.
- 2026-07-14: patched: Fix released in version 1.128.1.