EUVD-2026-44276
GHSA-8vjh-hxqp-x752
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Local delivery of crafted content (AV:L) requiring the user to open it (UI:R), no auth (PR:N); a bypassed sandbox yields high confidentiality/integrity impact but no availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionNVD
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Cross-site scripting in Microsoft Visual Studio Code lets an attacker who tricks a local user into opening crafted content bypass a built-in security feature and gain high-impact code execution within the editor context. The flaw (CWE-79) carries a CVSS 3.1 base score of 7.1 with a local attack vector requiring user interaction, and Microsoft has published an advisory with a fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to locally open or preview attacker-crafted content in VS Code - the CVSS UI:R confirms mandatory user interaction, and AV:L confirms local delivery rather than remote/network exploitation; no authentication is needed (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) describes a locally-delivered, low-complexity, unauthenticated issue that requires the victim to interact - consistent with a social-engineering delivery (open a malicious repo/file/notebook) rather than remote drive-by. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a repository or file (README, notebook, or extension-rendered content) containing an XSS payload and lures a developer into opening it in VS Code. When the victim opens or previews the crafted content, the injected script executes inside the editor's privileged rendering context and bypasses the intended sandbox/security feature. … |
| Remediation | Patch available per vendor advisory - update Visual Studio Code to the fixed build referenced in Microsoft's MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57101 (exact fixed version not stated in the available data; confirm on that page). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Visual Studio Code installations across the organization and send a security alert to development teams warning against opening untrusted files until patches are applied. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Privilege escalation in Microsoft Visual Studio Code versions 1.0.0 through 1.119.0 allows remote unauthenticated attack
Local privilege elevation in Microsoft Visual Studio Code allows an unprivileged attacker to gain higher privileges on a
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthoriz
GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today