CVE-2026-70094: Visual Studio Code Remote Code Execution Vulnerability

Q: What attacker interaction is required for exploitation?

The vulnerability requires user interaction. An attacker must induce a user to take an action that triggers use of the untrusted search path.

Q: Does exploitation require authentication or existing privileges?

No privileges are required. The vector is network-based, so an unauthorized attacker could attempt exploitation remotely.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation could allow code execution with high impact to confidentiality, integrity, and availability.

Published Nov 10, 2026

Updated

Untrusted search path in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Other sources

Visual Studio Code Remote Code Execution Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Visual Studio Code<1.145.3

1.145.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.145.3

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverity

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What attacker interaction is required for exploitation?

The vulnerability requires user interaction. An attacker must induce a user to take an action that triggers use of the untrusted search path.

Does exploitation require authentication or existing privileges?

No privileges are required. The vector is network-based, so an unauthorized attacker could attempt exploitation remotely.

What is the potential impact if exploitation succeeds?

Successful exploitation could allow code execution with high impact to confidentiality, integrity, and availability.

CVE-2026-70094: Visual Studio Code Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker interaction is required for exploitation?

Does exploitation require authentication or existing privileges?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What attacker interaction is required for exploitation?

Does exploitation require authentication or existing privileges?

What is the potential impact if exploitation succeeds?