EUVD-2026-35573
GHSA-rgv4-j5p6-g338
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
1DescriptionCVE.org
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over a network when a victim performs a required interaction, due to improper input validation classified as missing authentication (CWE-306). The flaw carries a critical CVSS 9.6 score with scope change, meaning a successful attack impacts resources beyond the vulnerable component. No public exploit identified at time of analysis, but the user-interaction trigger combined with VS Code's massive developer install base makes this a notable supply-chain-adjacent risk.
Technical ContextAI
Visual Studio Code is Microsoft's cross-platform code editor built on Electron, embedding Chromium and Node.js, and supports extensions, remote development, and various URI handlers (vscode://, vscode-insiders://) that can deep-link into the editor. The root cause is CWE-306 (Missing Authentication for Critical Function), which in this context - combined with the 'Authentication Bypass' tag and AV:N attack vector - indicates that a network-reachable code path inside VS Code accepts attacker-controlled input without verifying caller identity or trust boundaries. The scope-changed CVSS vector (S:C) suggests the vulnerable component's authorization boundary is crossed, allowing impact on the host operating system or other components beyond the editor process itself.
RemediationAI
Patch available per vendor advisory - consult the Microsoft Security Response Center page at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47281 to identify the exact fixed VS Code build and apply the update across developer workstations; enabling VS Code's auto-update channel is the most reliable path. As compensating controls until patching is complete, disable or unregister the vscode:// and vscode-insiders:// URI handlers at the OS level to break the network-delivered click-through attack path (side effect: breaks legitimate deep links from documentation and GitHub 'Open in VS Code' buttons), block opening workspaces and folders from untrusted sources by enforcing Workspace Trust and disabling 'Trust workspace' prompts via policy, and restrict installation of marketplace extensions to an allowlist via the extensions.allowed setting. Network-egress filtering alone will not mitigate this since attacks are likely delivered via web content the user already trusts to render.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today