EUVD-2026-56304
GHSA-432h-4h4q-x6r2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network vector and PR:N confirmed by missing authorization on a network endpoint; UI:R reflects mandatory victim interaction; full C/I/A:H consistent with arbitrary code execution in developer context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check (CWE-862) on a network-accessible code path, allowing an unauthenticated network attacker to execute arbitrary code on a victim's machine with high impact across confidentiality, integrity, and availability. Exploitation requires user interaction (CVSS UI:R), meaning the victim must engage with attacker-controlled content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running Visual Studio Code version 1.0.0 through 1.132.0 on a network-connected machine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a high-severity but not fully autonomous exploit - the mandatory user interaction step (UI:R) reduces exploitability compared to a fully hands-off network attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious VS Code workspace or crafts a URI/link that targets the unprotected network-accessible endpoint in a vulnerable VS Code instance. When the developer opens the workspace or follows the link - a routine action in collaborative development - the missing authorization check is bypassed and the attacker's payload executes in the VS Code process context, giving full access to the developer's local file system, secrets, and terminal. … |
| Remediation | Upgrade Visual Studio Code to version 1.132.1 or later, which contains the vendor-released patch as confirmed by EUVD EUVD-2026-56304 and the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59113. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of Visual Studio Code deployments across development teams and identify current versions in use. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attac
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today