CVE-2026-102238: Visual Studio Code Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Code Remote Code Execution Vulnerability
— Microsoft
Affected Software
1 affected componentFixes available
Microsoft Visual Studio Code<1.141.1
1.141.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverity
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attack can be conducted over a network with low attack complexity and does not require attacker privileges. User interaction is required for exploitation.
2
What is the potential impact of a successful exploit?
A successful exploit can allow code execution and is rated with high confidentiality, integrity, and availability impact. The CVSS vector also indicates the impact can extend beyond the initially affected security scope.