CVE-2026-102235: Visual Studio Code Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Code Remote Code Execution Vulnerability
— Microsoft
Affected Software
1 affected componentFixes available
Microsoft Visual Studio Code<1.141.1
1.141.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverity
Frequently Asked Questions
1
Does exploitation require an authenticated account or local access?
No. The vector is network-based and the vulnerability is rated as requiring no privileges, so an unauthorized attacker does not need an authenticated account or local access.
2
Is user interaction required for exploitation?
Yes. The vulnerability metrics indicate that user interaction is required, so exploitation depends on a user taking an action.