EUVD-2026-56289
GHSA-969h-r76q-fxg7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector (AV:L) confirmed by description; PR:N consistent with no attacker account required; UI:R required as victim must open manipulated workspace; high CIA impact consistent with full security-feature bypass.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Security feature bypass in Visual Studio Code (versions 1.0.0 through 1.132.1) exploits CWE-639, where authorization decisions rely on attacker-controllable keys, allowing a local attacker to circumvent an intended access control with high impact across confidentiality, integrity, and availability. The attack requires no elevated attacker privileges but does require a legitimate VS Code user to interact with the manipulated environment, pointing to shared-workstation or social-engineering delivery paths. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis; a vendor-released patch is available at version 1.132.1.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) occurs when an application uses an attacker-manipulable value - such as a file path, workspace identifier, object reference, or configuration key - as the basis for an authorization check, allowing substitution of a key that grants unintended access. Visual Studio Code's extensible workspace and settings architecture provides multiple surfaces where file-system-resident or user-supplied keys could influence security decisions; the vulnerability allows one of these keys to be crafted such that the IDE's security feature check is bypassed entirely. The CVSS AV:L confirms exploitation is confined to the local machine, while PR:N indicates no pre-existing account privileges are required from the attacker side; UI:R confirms a legitimate VS Code session must be initiated against the manipulated configuration. Affected versions span VS Code 1.0.0 through 1.132.1 (exclusive) per EUVD-2026-56289.
RemediationAI
Upgrade Visual Studio Code to version 1.132.1 or later, which contains the vendor-released fix for this authorization bypass; the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58650 is the authoritative patch reference. Where immediate patching is not feasible, restrict write access to VS Code workspace configuration directories and user settings files to prevent untrusted local accounts from planting manipulated keys - note this is a partial mitigation that reduces the attack surface without eliminating the underlying flaw, and may break legitimate multi-user workspace workflows. Auditing shared or multi-user VS Code environments for unexpected or externally sourced workspace configurations provides additional detection coverage until the patch is deployed.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today