CVE-2026-102233: Visual Studio Code Security Feature Bypass Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Other sources
Visual Studio Code Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running Microsoft Visual Studio Code are potentially exposed. The attack vector is local, so an attacker needs local access to the affected system rather than network-only access.
Does exploitation require an existing account or elevated privileges?
The provided CVSS vector indicates no privileges are required. However, user interaction is required before exploitation can occur.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at high impact levels. The vulnerability allows bypass of a security feature because of missing authorization.