What is the CVSS score of CVE-2026-57102?

CVE-2026-57102 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Visual Studio Code are affected by CVE-2026-57102?

Microsoft Visual Studio Code is vulnerable to a security-feature bypass (CVSS 8.8) that allows remote attackers to execute untrusted code when users open attacker-supplied files, creating a direct…. A patch is available.

How to fix or mitigate CVE-2026-57102?

Within 24 hours, inventory all VSCode installations and document current versions in deployment. Within 7 days, apply the vendor-released patch by updating all instances to the patched version using your standard software distribution process. Within 30 days, verify patch deployment completion and establish a software update policy for VSCode to ensure timely patching of future vulnerabilities.

Visual Studio Code CVE-2026-57102

EUVD-2026-44277 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-14 microsoft

GHSA-3r7w-m284-m5r3

Authentication Bypass Visual Studio Code

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-delivered untrusted content needs no privileges (PR:N) but requires the victim to open it (UI:R); inclusion of untrusted functionality yields high C/I/A within the editor's unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:55 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 8.8

DescriptionCVE.org

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted control sphere (CWE-829) that circumvents a built-in protection, yielding high confidentiality, integrity, and availability impact once a victim opens or interacts with attacker-supplied content. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), it requires user interaction but no authentication, and Microsoft has released a fix via MSRC. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host malicious repository or file

Delivery

Lure developer to open in VS Code

Exploit

Untrusted functionality loaded and included

Execution

Bypass security feature

Impact

Compromise editor confidentiality/integrity/availability

Access

Host malicious repository or file

Delivery

Lure developer to open in VS Code

Exploit

Untrusted functionality loaded and included

Execution

Bypass security feature

Impact

Compromise editor confidentiality/integrity/availability

Vulnerability AssessmentAI

Exploitation	Exploitation requires user interaction (CVSS UI:R): the victim must open or interact with attacker-controlled content in Visual Studio Code - such as a malicious repository, workspace, file, or link that causes the editor to include functionality from an untrusted control sphere. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H drives the 8.8 score: network vector, low complexity, no privileges, but mandatory user interaction (UI:R) - meaning a victim must open a repository, file, or link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a malicious repository or file - for example a project with hostile workspace configuration or a component referenced from an untrusted location - and lures a developer into opening it in Visual Studio Code. When the victim opens the content (UI:R), the untrusted functionality loads and bypasses the intended security feature, giving the attacker high-impact control over the editor's context. …
Remediation	Patch available per vendor advisory: update Visual Studio Code to the fixed release identified in the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57102 (the exact patched version is listed there; it is not restated in this feed, so consult MSRC for the precise build). … Detailed patch versions, workarounds, and compensating controls in full report.