CVE-2026-114171: Visual Studio Code Security Feature Bypass Vulnerability

Q: What does an attacker need to exploit this issue?

The attacker can attempt exploitation over a network and does not require prior privileges or a complex attack path. However, user interaction is required.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can bypass a security feature in Visual Studio Code. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.

Q: Are Visual Studio Code users exposed by default?

The provided information identifies Microsoft Visual Studio Code as affected, but does not state which versions, configurations, or default settings are vulnerable.

Published Nov 10, 2026

Updated

User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Other sources

Visual Studio Code Security Feature Bypass Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Visual Studio Code<1.145.3

1.145.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.145.3

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:22 PM

Data Sourced

via MITRE·06:22 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker can attempt exploitation over a network and does not require prior privileges or a complex attack path. However, user interaction is required.

What is the potential impact if exploitation succeeds?

Successful exploitation can bypass a security feature in Visual Studio Code. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.

Are Visual Studio Code users exposed by default?

The provided information identifies Microsoft Visual Studio Code as affected, but does not state which versions, configurations, or default settings are vulnerable.

CVE-2026-114171: Visual Studio Code Security Feature Bypass Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Are Visual Studio Code users exposed by default?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Are Visual Studio Code users exposed by default?