CVE-2026-120782: Visual Studio Code Security Feature Bypass Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must be able to act locally, as indicated by the local attack vector. No privileges are required, but user interaction is required.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation could affect confidentiality, integrity, and availability at a high level. The issue is described as a bypass of a Visual Studio Code security feature caused by improper control of code generation.

Q: Can this be exploited remotely over the network?

The provided vector identifies the attack vector as local. The available information does not indicate a network-based exploitation path.

Published Nov 10, 2026

Updated

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Other sources

Visual Studio Code Security Feature Bypass Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Visual Studio Code<1.145.3

1.145.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.145.3

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must be able to act locally, as indicated by the local attack vector. No privileges are required, but user interaction is required.

What is the potential impact if exploitation succeeds?

Successful exploitation could affect confidentiality, integrity, and availability at a high level. The issue is described as a bypass of a Visual Studio Code security feature caused by improper control of code generation.

Can this be exploited remotely over the network?

The provided vector identifies the attack vector as local. The available information does not indicate a network-based exploitation path.

CVE-2026-120782: Visual Studio Code Security Feature Bypass Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Can this be exploited remotely over the network?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Can this be exploited remotely over the network?