Visual Studio Code CVE-2026-47285

User interaction is required: the victim must actively open attacker-controlled content in VS Code - such as a malicious workspace folder, a crafted tasks.json or launch.json configuration, or a repository containing injected command strings - as confirmed by the CVSS UI:R metric. No authentication or privileges are required on the attacker's side (PR:N per CVSS vector). The vulnerability is bounded to VS Code installations running versions below 1.132.1. Impact is limited to confidentiality - integrity and availability of the victim system are not directly affected. Exploitation is constrained by the victim-interaction requirement, ruling out automated scanning or worm-style propagation; however, supply chain scenarios (malicious public repositories or shared workspace configurations) and spear-phishing delivery are realistic vectors. The attack is platform-agnostic given VS Code's cross-platform nature.

The CVSS base score of 6.5 (Medium) reflects a network-accessible, low-complexity attack requiring no attacker privileges but mandating victim interaction (AV:N/AC:L/PR:N/UI:R). The confidentiality-only impact (C:H/I:N/A:N) bounds the worst-case outcome to information disclosure rather than full system compromise or availability disruption - a meaningful constraint that prevents this from being a critical-tier finding despite the high confidentiality impact metric. No EPSS score was provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no identified public POC further reduces urgency relative to the CVSS score alone. However, the attack is viable in targeted phishing or malicious-repository scenarios due to the zero-privileges-required posture: an attacker need only induce the victim to open a crafted workspace. Developers who routinely clone and open third-party repositories represent an elevated-risk population. The UI:R requirement prevents automated mass exploitation. Overall, this is a genuine medium priority for organizations with large VS Code deployments, particularly those where developers regularly open external or community-sourced repositories.

An attacker embeds malicious command sequences within a VS Code workspace configuration file (e.g., tasks.json or launch.json) in a public or privately distributed repository. When a developer clones the repository and opens it in a vulnerable VS Code instance, the injected commands execute within the VS Code process context and exfiltrate sensitive local data - such as environment variables containing API keys, SSH agent sockets, or local credential files - to an attacker-controlled server over the network. No public POC has been identified at time of analysis, but the attack is straightforward to construct for an attacker with knowledge of VS Code workspace internals.