Executive brief
Visual Studio Code is a widely-used source code editor. A path traversal flaw allows an attacker to access or modify files outside of intended directories through a network connection, potentially compromising code repositories, build artifacts, or sensitive project files.
Technical details
The vulnerability is a path traversal (CWE-22) in Visual Studio Code that fails to properly validate or restrict file paths. An attacker with network access can craft malicious paths containing directory traversal sequences (e.g., "../") to bypass intended access controls and read or write files outside the restricted directory. The attack requires network connectivity but does not require authentication. Successful exploitation could lead to unauthorized data access, code injection, or tampering with project files. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-09-08: disclosed