Visual Studio Code CVE-2026-48569

Exploitation requires the victim to locally open attacker-controlled content (workspace, file, or URI) in Visual Studio Code - this is the UI:R user-interaction requirement and AV:L local-vector constraint from the CVSS string. No authentication to VS Code is required (PR:N), but the attacker must deliver the malicious workspace/file to the developer's machine via social engineering, a malicious repository clone, a phishing attachment, or a vscode:// URI link. Exploitation is limited by the need for a human to actually open the payload in VS Code and by whatever specific security feature (Workspace Trust, sandbox, or restricted-mode check) is bypassed; it cannot be triggered by network-only access to the host, and headless or unattended systems are not viable targets.

Real-world risk is moderate rather than urgent. CVSS 7.1 is driven by local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) - the victim must open a malicious workspace, file, or link in VS Code. The scope change and C:H/I:L impact mean a successful bypass can leak sensitive data across the trust boundary, but it cannot be triggered purely remotely or wormed. No EPSS score, KEV listing, SSVC decision, or POC data was supplied with this advisory, so automated exploitation probability cannot be quantified; the absence of KEV and POC signals suggests this is not currently a widespread exploitation priority. Given VS Code's massive developer install base, however, this is a plausible target for supply-chain or social-engineering campaigns (malicious repo lures), so it should be patched promptly even if not treated as an emergency.

An attacker publishes a malicious Git repository, ZIP archive, or .code-workspace file - for example via a typosquatted package, a phishing email, or a poisoned GitHub link - and persuades a developer to open it in VS Code. When the victim opens the crafted content locally, the improper input validation flaw bypasses the intended security feature (likely Workspace Trust or a sandboxing check), allowing the attacker's payload to read sensitive workspace data or files beyond its expected sandbox. No public exploit has been identified at time of analysis.