EUVD-2026-35698
GHSA-cw93-p7fx-xgqx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Relative path traversal in Visual Studio Code versions prior to 1.123.1 enables unauthenticated remote attackers to tamper with files outside the intended directory boundary, producing a high integrity impact with no confidentiality or availability loss. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack requires no privileges and is low-complexity over a network, but depends on a victim interacting with attacker-controlled content. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-23 (Relative Path Traversal) describes a failure to sanitize relative path sequences such as '../' or './' within user-controlled input before using it to construct file system paths. In Visual Studio Code, a widely deployed Electron-based IDE by Microsoft, this class of flaw can manifest in workspace or extension processing code that accepts externally-supplied path components without normalization, allowing writes to escape the intended working directory. The affected version range per EUVD is Visual Studio Code 1.0.0 through below 1.123.1. The network attack vector with user interaction suggests the vulnerability is triggered when a user opens a crafted file, workspace configuration, or remote resource within the editor rather than through an autonomous server-side code path.
RemediationAI
The primary remediation is to upgrade Visual Studio Code to version 1.123.1 or later, which addresses the relative path traversal per the vendor-released patch. The Microsoft Security Response Center advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287. As a compensating control where immediate upgrade is not feasible, restrict opening of untrusted workspaces, workspace files (.code-workspace), or repository folders from unknown sources, as user interaction is required to trigger the vulnerability - preventing exposure to untrusted content directly limits exploitation opportunity. Note that this control relies on user discipline and does not eliminate the underlying flaw. No additional workarounds were specified in vendor guidance at time of analysis.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today