Executive brief
Visual Studio Code, a widely-used source code editor, contains a path traversal vulnerability that allows an attacker to bypass security restrictions over the network. This could enable unauthorized access to restricted files or directories on a developer's machine, potentially exposing sensitive source code, credentials, or configuration data.
Technical details
A path traversal vulnerability (CWE-22) in Visual Studio Code permits an attacker to access files outside intended directory boundaries by manipulating pathname input. The vulnerability is reachable over the network, allowing an unauthenticated or remote attacker to bypass built-in security restrictions. By exploiting this flaw, an attacker can enumerate or access sensitive files such as source code, credentials, or configuration data stored on the developer's system. Patch availability has not been confirmed from the advisory text.
Affected products
- Microsoft Visual Studio Code <UNKNOWN>
Timeline
- 2026-09-08: disclosed