What is the CVSS score of CVE-2026-41612?

CVE-2026-41612 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41612?

Yes, a patch is available for CVE-2026-41612. Update the affected software to the latest version immediately.

Live Preview Extension CVE-2026-41612

EUVD-2026-29695 MEDIUM

Relative Path Traversal (CWE-23)

2026-05-12 microsoft

Path Traversal Microsoft Visual Studio Code Live Preview Extension

5.5

CVSS 3.1 · NVD

Temporal: 4.8

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

4.8 MEDIUM

cvss

vuln.today AI

5.5 MEDIUM

Local attack vector with required user interaction reflects developer workstation context; no integrity or availability impact from read-only path traversal.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 21:39 vuln.today

CVE Published

May 12, 2026 - 16:58 nvd

MEDIUM 5.5

DescriptionCVE.org

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

AnalysisAI

Path traversal in the Visual Studio Code Live Preview extension (versions 0.4.0 through 0.4.18) enables a local attacker to read arbitrary files outside the intended workspace directory by exploiting insufficient path validation in the extension's embedded HTTP server. The flaw (CWE-23) can expose sensitive local files such as credentials or private keys to any party who can supply a crafted file to a developer and have them trigger the preview feature. No public exploit code exists and the vulnerability is absent from CISA KEV; Microsoft has released a fix in version 0.4.19.

Technical ContextAI

The affected product is the Microsoft Visual Studio Code Live Preview extension (CPE: cpe:2.3:a:microsoft:visual_studio_code_-_live_preview_extension), versions 0.4.0 through 0.4.18 per EUVD-2026-29695. The extension runs an embedded local HTTP server inside VS Code to render HTML files as live, in-editor browser previews during development. CWE-23 (Relative Path Traversal) identifies the root cause: the server does not adequately canonicalize or sanitize file paths before resolving them, allowing traversal sequences such as '../../' in resource references (e.g., img src, script src, fetch URLs) to escape the intended workspace web root and reach arbitrary filesystem locations accessible to the current user. This class of flaw is endemic to developer-facing embedded web servers that prioritize convenience, where strict path confinement is often an afterthought.

RemediationAI

The primary and recommended fix is to update the Visual Studio Code Live Preview extension to version 0.4.19 or later, which Microsoft has confirmed resolves this path traversal, per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612. Updates are applied via the VS Code Extensions panel (View > Extensions > search 'Live Preview' > Update) or by running 'code --install-extension ms-vscode.live-server' from the terminal. If immediate patching is not feasible, disabling the Live Preview extension entirely via the Extensions panel eliminates the attack surface at the cost of losing in-editor HTML preview functionality. Instructing developers not to open untrusted workspaces or HTML files while the extension is active also reduces exposure, though this is a behavioral control rather than a technical one.