EUVD-2026-43992
GHSA-3v99-gw88-f2cw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network attacker intercepts credentials during user-triggered VS Code action; no attacker privileges needed, but UI:R dependency limits automation; no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Credential disclosure in Visual Studio Code (including GitHub Copilot integration) exposes user credentials to network-positioned attackers across all versions prior to 1.128.1. Rooted in CWE-522 (Insufficiently Protected Credentials), the flaw enables a remote unauthenticated attacker to capture credentials when a user performs a triggering action, potentially granting access to GitHub or Microsoft services. No active exploitation is confirmed (SSVC: Exploitation none; not in CISA KEV), and the EPSS score of 0.60% reflects low observed exploitation probability at time of analysis.
Technical ContextAI
CWE-522 (Insufficiently Protected Credentials) indicates that credentials - likely GitHub authentication tokens or Microsoft account credentials used by VS Code and the GitHub Copilot extension - are transmitted or stored without adequate protection, such as in cleartext or with weak encryption over a network channel. The affected product is identified by CPE cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* covering all VS Code releases from 1.0.0 up to (but not including) 1.128.1. GitHub Copilot relies on OAuth or PAT-based authentication to GitHub's API; a failure in credential handling at the VS Code layer could expose these tokens during network transmission or inter-process communication, depending on the specific implementation flaw. The CVSS network attack vector (AV:N) confirms credential exposure occurs over the network rather than being a purely local storage issue.
RemediationAI
The primary fix is to upgrade Visual Studio Code to version 1.128.1 or later, which addresses the credential protection deficiency per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47282. VS Code typically auto-updates, but users on managed or air-gapped environments should apply the update manually. As a compensating control prior to patching, administrators can restrict outbound network access from developer workstations to known-good Microsoft and GitHub endpoints using an allowlist firewall policy, reducing the window for credential interception; note this may disrupt Copilot functionality in environments with non-standard egress routing. Rotating any GitHub Personal Access Tokens or OAuth tokens associated with affected VS Code sessions after upgrading is advisable as a precaution, since credentials exposed prior to patching remain valid until revoked.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today