CVE-2026-102234: Visual Studio Code Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Other sources
Visual Studio Code Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
The vulnerability is network-reachable and requires no privileges, but it does require user interaction. The available information does not specify what action the user must take.
What is the potential impact?
A successful attacker can bypass a Visual Studio Code security feature. The supplied severity vector indicates high confidentiality impact, no integrity or availability impact, and a scope change.
Can I determine whether a particular Visual Studio Code installation is affected from this information?
No affected or fixed Visual Studio Code versions are provided. The supplied information also does not identify a configuration, feature setting, or indicator that can be used to confirm exposure.