CVE-2026-70098: Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Code Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is described as exploitable over a network by an unauthorized attacker, so no prior privileges are required. Exploitation does require user interaction.
What is the potential impact of successful exploitation?
Successful exploitation can allow remote code execution. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.
Is exploitation expected to be easy?
The severity vector rates attack complexity as low, meaning no special conditions or complex exploitation path are indicated. However, user interaction is required.