Executive brief
Visual Studio Code, a widely-used code editor, contains a flaw where it fails to securely handle certain error conditions. Instead of blocking access when a security check fails, the application incorrectly proceeds with the operation (failing open). An attacker on a network can exploit this to bypass security features and gain unauthorized access to functionality that should be restricted.
Technical details
Visual Studio Code is affected by an improper error handling vulnerability classified as "failing open" or "failing securely" flaw (CWE-391 or similar). When a security validation or check encounters an error condition, the application continues execution instead of denying access, creating a bypass path for security features. The vulnerability is reachable over the network without requiring prior authentication. An attacker can craft network requests to trigger the error condition and bypass intended security controls. Patches are expected to be available through Microsoft's security updates.
Affected products
- Microsoft Visual Studio Code
Timeline
- 2026-09-08: disclosed
- 2026-09-08: advisory