Visual Studio Code CVE-2026-57101

Exploitation requires the victim to locally open or preview attacker-crafted content in VS Code - the CVSS UI:R confirms mandatory user interaction, and AV:L confirms local delivery rather than remote/network exploitation; no authentication is needed (PR:N). The concrete prerequisite is that the user renders untrusted input on one of VS Code's HTML surfaces (webview/Markdown preview/notebook renderer/extension content) that fails to neutralize the injected script. Limiting factors: the attack cannot be triggered remotely without the user opening the malicious content, Workspace Trust/Restricted Mode can blunt the trust-dependent surfaces, and patched builds remove the injection path. The exact triggering surface is not specified in the available data and should be confirmed against the Microsoft advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) describes a locally-delivered, low-complexity, unauthenticated issue that requires the victim to interact - consistent with a social-engineering delivery (open a malicious repo/file/notebook) rather than remote drive-by. The high confidentiality and integrity impact reflects meaningful editor-context compromise, but the local vector and mandatory user interaction materially lower real-world exploitability versus a network-facing RCE. No EPSS score, POC, or KEV entry was provided, so exploitation appears theoretical at this stage: this is a patch-in-normal-cycle priority for most environments, elevated for developer fleets that routinely open untrusted third-party repositories. Note a scope consideration to verify with the vendor: the description frames the impact as 'bypass a security feature locally,' which is narrower than full arbitrary code execution - the C:H/I:H rating may reflect what a bypassed sandbox subsequently enables rather than the XSS alone.

An attacker publishes a repository or file (README, notebook, or extension-rendered content) containing an XSS payload and lures a developer into opening it in VS Code. When the victim opens or previews the crafted content, the injected script executes inside the editor's privileged rendering context and bypasses the intended sandbox/security feature. No public exploit was identified at time of analysis; the local vector and required user interaction mean the attacker depends on social engineering.