EUVD-2026-43993
GHSA-m7vq-9w86-qx38
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local-only attack requiring an existing low-privilege account; read-only traversal yields high confidentiality but zero integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Path traversal in Microsoft Visual Studio Code (all versions from 1.0.0 up to 1.128.1) enables a locally-authenticated low-privilege attacker to bypass a file-system security boundary and read files outside a restricted directory, resulting in high confidentiality impact. The vulnerability is rated CVSS 5.5 Medium and is limited to local attack vectors, requiring PR:L authenticated access. No public exploit code or active exploitation has been identified at time of analysis; EPSS stands at 0.45% and SSVC designates exploitation status as none, making this a lower-priority remediation item despite the High confidentiality impact rating.
Technical ContextAI
Visual Studio Code is an Electron/Node.js-based code editor that enforces security boundaries such as workspace trust and restricted file-system scopes to prevent unauthorized access to files outside the intended working context. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes the root cause: the application fails to adequately canonicalize or sanitize user-controlled path inputs, allowing traversal sequences to escape the restricted directory boundary. The affected product is fully identified via CPE cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*, encompassing all platform variants (Windows, macOS, Linux) running versions from 1.0.0 through 1.128.0. The vulnerability produces no integrity or availability impact - it is a read-primitive only - consistent with a directory escape that exposes file content without enabling writes or process disruption.
RemediationAI
The primary remediation is upgrading Visual Studio Code to version 1.128.1 or later, which contains the vendor-released patch as confirmed by the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45496. Users can update via the VS Code built-in updater (Help > Check for Updates) or by downloading the latest release directly from the official Microsoft distribution channel. For environments where immediate upgrade is not feasible, compensating controls include restricting local system access to trusted users only (reducing the pool of potential PR:L attackers), enabling OS-level file-system access controls (ACLs/permissions) to limit what files the VS Code process can reach even if traversal occurs, and reviewing VS Code workspace trust settings to minimize the attack surface. Note that these compensating controls reduce exposure but do not eliminate the underlying path traversal flaw. Additional detail is available via NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-45496.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today