EUVD-2026-35536
GHSA-rg3p-gp39-622w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network input handler (AV:N/PR:N/UI:N) with specialised timing/config prerequisites (AC:H) yielding full code-execution-class impact in the user's context (C:H/I:H/A:H, S:U).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Visual Studio Code versions 1.0.0 through 1.119.0 allows remote unauthenticated attackers to elevate privileges over a network by exploiting improper input validation (CWE-20). Microsoft has released a patched build (1.119.1) and SSVC rates technical impact as total, though EPSS remains low at 0.09% with no public exploit identified at time of analysis.
Technical ContextAI
Visual Studio Code is Microsoft's cross-platform source-code editor built on the Electron framework, which combines Chromium and Node.js to execute web technologies with local OS privileges. The root cause is CWE-20 (Improper Input Validation), meaning the editor accepts data from a network-reachable surface without enforcing expected syntactic, semantic, or length constraints before passing it to a privileged operation. The single CPE microsoft:visual_studio_code:* confirms the desktop editor itself is in scope rather than a specific extension, and the 'Authentication Bypass' tag indicates the malformed input is processed before any identity check is enforced, allowing the attacker's input to reach privileged code paths intended for authenticated users.
RemediationAI
Vendor-released patch: Visual Studio Code 1.119.1 - upgrade all instances to 1.119.1 or later via the in-app auto-updater, MSI/DEB/RPM packages, or your endpoint management tool, using the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40376 as the authoritative reference. No vendor-supplied workaround is published; compensating controls until rollout completes include disabling Remote Tunnels (settings 'remote.tunnels.access') and Live Share on managed workstations to remove the externally reachable surface (trade-off: blocks remote pair programming and cloud-hosted dev workflows), restricting outbound connections from VS Code processes to known Microsoft endpoints via host firewall (may break marketplace updates if over-restricted), and requiring users to only open trusted workspaces under Workspace Trust (already default, but verify policy enforcement). Cross-reference VulDB entry https://vuldb.com/vuln/369591 for additional triage data.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today