CVE-2026-102231: Visual Studio Code Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Other sources
Visual Studio Code Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Frequently Asked Questions
What access and interaction are required for exploitation?
Exploitation is local and requires user interaction. The attacker does not need privileges according to the supplied CVSS vector, but successful exploitation also has high attack complexity.
What security impact could successful exploitation have?
A successful bypass can have high impact on confidentiality, integrity, and availability. The scope is changed, indicating impacts may extend beyond the initially affected security authority.
How can I determine whether an installation is affected?
The provided information identifies Microsoft Visual Studio Code as affected but does not specify affected or fixed versions. Use the referenced Microsoft advisory to compare the installed version with vendor guidance.