EUVD-2026-29694Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker delivers content the victim must open locally (AV:L, UI:R) with no attacker privileges (PR:N); XSS bridging to code execution yields total local impact (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Technical ContextAI
Visual Studio Code is an Electron/Chromium-based editor that renders many surfaces (Markdown previews, extension webviews, notebook outputs, hover cards) as HTML. CWE-80 (Improper Neutralization of Script-Related HTML Tags - basic XSS) indicates that attacker-controlled content containing tags such as <script> or event-handler attributes is inserted into one of these HTML contexts without adequate sanitization. Because VS Code webviews run with elevated privileges relative to a normal browser page and can bridge to the extension host, injected script can escalate from DOM execution toward local code execution, consistent with the CVSS scope-unchanged, high-impact rating. The only affected CPE is cpe:2.3:a:microsoft:visual_studio_code:*, i.e. the desktop editor itself rather than a specific extension.
RemediationAI
Vendor-released patch: upgrade to Visual Studio Code 1.119.1 or later, which is the first version outside the affected range per EUVD; consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611 for the exact build and channel details. Enabling VS Code auto-update ensures the fix is applied on next launch. Until updated, reduce exposure by not opening untrusted files, repositories, or workspaces, and use Workspace Trust / Restricted Mode so that automatic features (Markdown preview rendering, extension webviews, notebook execution) that could render attacker HTML stay disabled for untrusted content - the trade-off is reduced convenience/functionality when working in untrusted folders. Limiting installation of untrusted extensions further shrinks the set of webview surfaces that could carry a malicious payload.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today