What is the CVSS score of CVE-2026-57102?

CVE-2026-57102 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Visual Studio Code are affected by CVE-2026-57102?

Microsoft Visual Studio Code is vulnerable to a security-feature bypass (CVSS 8.8) that allows remote attackers to execute untrusted code when users open attacker-supplied files, creating a direct…. A patch is available.

How to fix or mitigate CVE-2026-57102?

Within 24 hours, inventory all VSCode installations and document current versions in deployment. Within 7 days, apply the vendor-released patch by updating all instances to the patched version using your standard software distribution process. Within 30 days, verify patch deployment completion and establish a software update policy for VSCode to ensure timely patching of future vulnerabilities.

Visual Studio Code CVE-2026-57102

EUVD-2026-44277 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-14 microsoft

GHSA-3r7w-m284-m5r3

Authentication Bypass Microsoft Visual Studio Code

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-delivered untrusted content needs no privileges (PR:N) but requires the victim to open it (UI:R); inclusion of untrusted functionality yields high C/I/A within the editor's unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:55 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 8.8

DescriptionCVE.org

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted control sphere (CWE-829) that circumvents a built-in protection, yielding high confidentiality, integrity, and availability impact once a victim opens or interacts with attacker-supplied content. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), it requires user interaction but no authentication, and Microsoft has released a fix via MSRC. There is no public exploit identified at time of analysis and it is not on the CISA KEV list.

Technical ContextAI

Visual Studio Code is Microsoft's cross-platform Electron-based source-code editor, which pulls in extensions, workspace configuration, and remote/web content that can originate outside the trusted boundary. The vulnerability maps to CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere), meaning the editor loads or executes code/resources controlled by a party the security model should not trust - for example workspace-scoped settings, extension logic, or remotely referenced components - thereby defeating a guardrail intended to gate that behavior. The affected CPE is cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* (all versions prior to the patched build); the exact fixed version is enumerated in the MSRC advisory but not restated in this feed.

RemediationAI

Patch available per vendor advisory: update Visual Studio Code to the fixed release identified in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102 (the exact patched version is listed there; it is not restated in this feed, so consult MSRC for the precise build). Because VS Code auto-updates by default, ensure the auto-update channel is enabled and force a restart, or push the current release through your software-management tooling to remove the vulnerable version fleet-wide. As interim compensating controls, enable and do not disable Workspace Trust so untrusted folders open in restricted mode (trade-off: prompts and reduced functionality when opening new projects), and instruct developers not to open repositories, files, or links from untrusted sources until patched (trade-off: relies on user discipline rather than a technical gate).