EUVD-2026-56562
GHSA-hm99-pwvc-xj2r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:N is plausible as any local user can trigger the bypass without prior elevation; UI:R reflects required user action to invoke the vulnerable code path.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Local security feature bypass in Visual Studio Code allows an attacker with local access to circumvent an authorization control, achieving high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability (CWE-693, Protection Mechanism Failure) is exploitable locally without elevated privileges but requires user interaction, making social engineering or physical access the likely delivery path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running a vulnerable version of Visual Studio Code. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.8 reflects a serious local impact with a High C/I/A triad, but several signals modulate real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patch released by Microsoft via the Visual Studio Code update mechanism or the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69278. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Visual Studio Code installations across development teams and assess which systems contain sensitive source code, credentials, or have elevated network access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today