EUVD-2026-35574
GHSA-ggv7-g73m-p34c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Visual Studio Code versions 1.0.0 through 1.123.0 allows an unauthenticated remote attacker to exfiltrate sensitive information over a network by inducing user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) indicates that while no authentication or elevated complexity is required on the attacker's side, the victim must perform some interaction to trigger the exposure - likely opening a malicious file, workspace, or following a crafted link within the IDE environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact and zero-privilege requirement make this a meaningful risk for developer workstations handling secrets, tokens, or source code.
Technical ContextAI
Visual Studio Code is Microsoft's Electron-based cross-platform IDE, widely deployed in enterprise and developer environments where it routinely processes source code containing credentials, API keys, and configuration secrets. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes a root cause where the application inadvertently surfaces sensitive data to a party that should not have access - this can manifest as unintended network requests leaking file contents, workspace data, or environment variables to an attacker-controlled endpoint. The network attack vector (AV:N) combined with unchanged scope (S:U) suggests the disclosure occurs within the VS Code process boundary rather than escaping to the underlying OS. The ENISA EUVD identifier EUVD-2026-35574 corroborates the NVD/MSRC record. The affected CPE range covers all VS Code releases from 1.0.0 up to but not including 1.123.1.
RemediationAI
Upgrade Visual Studio Code to version 1.123.1 or later, which contains the vendor-released patch per Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47284. The fix version 1.123.1 is confirmed by ENISA EUVD-2026-35574 sourced from the affected version range. Users can update via the VS Code built-in updater (Help > Check for Updates) or by downloading the latest release from the official Microsoft distribution channel. As a compensating control prior to patching, administrators should advise developers to avoid opening untrusted workspaces, files, or extensions, and to disable any VS Code features that make outbound network requests to external or unrecognized endpoints (e.g., experimental features, third-party extensions with network permissions). Disabling untrusted workspace mode and restricting extension installations to verified publishers reduces the attack surface, though these controls do not eliminate the underlying vulnerability and carry the trade-off of reduced developer productivity.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today