VS Code Python CVE-2026-54981

The victim must have the Python extension for Visual Studio Code (version prior to 1.132.1) installed and must actively open a workspace or project directory controlled by the attacker - for example, by cloning a malicious git repository and opening it in VS Code. This user interaction (UI:R) is the critical prerequisite: the attack cannot proceed without the victim opening the crafted workspace. The attacker does not require any system-level privileges (PR:N), only the ability to deliver a malicious workspace to the victim (e.g., via a public repository, shared archive, or phishing). Exploitation is limited to the local machine context (AV:L); remote network exploitation without prior workspace delivery is not possible. The specific protection mechanism being bypassed is not named in available data, but the CWE-693 classification and tags suggest an authentication or interpreter validation control within the extension.

The CVSS base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the threat profile: local attack vector, low complexity, no attacker privileges required, but mandatory user interaction. EPSS data was not provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. KEV status is absent, indicating no confirmed active exploitation by CISA. No POC is identified. Despite the lack of confirmed exploitation, the risk to developer populations is meaningful: the Python extension has an enormous install base, and developer machines are high-value targets (source code, credentials, CI/CD tokens). The combination of PR:N and AV:L is notable - it implies that while the attack is local, the attacker does not need privileged system access, consistent with workspace-poisoning attacks where the attacker's only foothold is crafting a malicious project that a victim opens. The full C:H/I:H/A:H triad suggests code execution within the VS Code process context. Real-world prioritization should be HIGH for developer workstations, particularly in organizations where developers clone external repositories from untrusted sources. The absence of an EPSS score and KEV listing limits confidence in quantifying immediate threat.

An attacker crafts a malicious Python project repository containing workspace-level configuration designed to redirect the VS Code Python extension to load attacker-controlled interpreter paths or configuration overrides. When a developer clones and opens the project in VS Code with the Python extension installed, the extension processes the workspace configuration and loads functionality from the untrusted control sphere, bypassing a protection mechanism and achieving code execution within the developer's VS Code process. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the technique requires no specialized expertise beyond crafting the malicious workspace artifact.