EUVD-2026-100599
GHSA-c644-53ww-gqgc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious file or repository
-
DeliveryLure developer to open in VS Code
-
ExploitTrigger missing authorization check
-
ExecutionExecute code on workstation
-
ImpactCompromise developer environment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open attacker-controlled content in Visual Studio Code - reflected by UI:R in the CVSS vector - such as a malicious workspace, repository, or file; it is not a server-side listener that an attacker reaches directly. No special non-default configuration is named in the description, and PR:N means no prior authentication on the target is needed, but the mandatory user-interaction step and the fact that impact is confined to the editor's local user context (S:U) are the primary limiting factors. Affected deployments are instances running Visual Studio Code versions below 1.141.1; updating to 1.141.1 or later removes the condition. |
| Impact | This is a credible priority for environments where developers run Visual Studio Code, but it is not a drop-everything internet-facing emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, unauthenticated code execution with high impact across confidentiality, integrity and availability - however UI:R means it is not self-propagating and requires a victim to take an action (e.g. open a malicious file, workspace, or repository). The weakness is CWE-862 Missing Authorization, meaning an authorization check that should gate a code-execution path is absent, so the 'attacker' is effectively content the user is lured into opening rather than a direct remote session. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit was provided, so there is no evidence of active or at-scale exploitation - risk today is latent/potential. The signals are internally consistent (network + user interaction + high impact fits a malicious-content scenario), so there is no obvious contradiction to flag, but the absence of EPSS/KEV/POC means exploitation likelihood is unquantified rather than confirmed low. |
| Exploit ScenarioDerived | An attacker crafts a malicious file, repository, or workspace that abuses the missing authorization check and lures a developer into opening it in Visual Studio Code (e.g. via a shared project or supply-chain repo). When the victim opens the content, code executes in the context of their editor/workstation. No public proof-of-concept was provided, so this scenario is inferred from the CVSS vector (network delivery, required user interaction) rather than observed exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Missing authorization in Visual Studio Code allows code execution in the context of the editor's local user when a victim opens attacker-controlled content, such as a malicious workspace, repository, or file; the flaw affects versions from 1.0.0 up to but not including 1.141.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) shows no prior authentication is needed on the target, but successful exploitation still hinges on the mandatory user-interaction step, and the resulting impact stays within the user's own session rather than crossing a privilege or scope boundary. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible patch-priority for developer endpoints rather than a drop-everything internet-facing emergency; Microsoft rates the fix as available.
RemediationAI
Vendor-released patch: update Visual Studio Code to 1.141.1 or later - the exact fixed version identified in the EUVD affected-range data - following the Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70098. Because the vector requires user interaction (UI:R), the fastest practical mitigation for unpatched endpoints is to avoid opening untrusted workspaces, repositories, and files and to keep Workspace Trust in Restricted Mode so that untrusted folders cannot auto-execute workspace-defined tasks, debug configurations, or extension code; the trade-off is reduced editor functionality and disabled extensions in those folders. Additional compensating controls include restricting the ability to install or auto-enable extensions from untrusted sources and blocking inbound distribution of unsolicited workspace archives, though these reduce rather than eliminate exposure since the user must still open the crafted content for the flaw to trigger. None of these workarounds are a substitute for upgrading to 1.141.1, and no compensating control should be presented as equivalent to the vendor fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization): a code path in Visual Studio Code fails to verify that the caller is permitted to perform the requested action, so an unauthorized party can trigger functionality that should have been gated. Visual Studio Code is an Electron/Node.js-based cross-platform code editor that loads workspace folders, configuration files, and extension-host code with the privileges of the logged-in developer, which is why a missing authorization check can escalate into arbitrary code execution in the local user context (C:H/I:H/A:H) rather than being confined to data exposure. The network attack vector with user interaction (AV:N/AC:L/PR:N/UI:R/S:U) maps precisely to the delivery model: the attacker supplies a crafted workspace, repository, or file over a network channel and waits for the victim to open it in the editor. The accompanying "Authentication Bypass" tag aligns with the CWE classification, while the unchanged scope (S:U) confirms the impact does not escape the editor's security boundary. EUVD records the affected range as Visual Studio Code 1.0.0 through versions below 1.141.1, and the only reference in the input is the Microsoft Security Response Center update guide entry for CVE-2026-70098.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious content is delivered over the network and needs no prior auth (AV:N/PR:N) but requires the user to open it (UI:R); code execution in the user context yields high C/I/A with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Executive ViewAI
Visual Studio Code versions prior to 1.141.1 contain a missing authorization flaw that allows code execution in the context of the editor's local user when a victim opens attacker-controlled content. The flaw is unauthenticated on the target but requires user interaction, and no public exploit identified at time of analysis; however, developer endpoints often hold sensitive credentials and repository access, so compromise could expose source code or enable lateral movement. Leadership should prioritize patching developer workstations to 1.141.1 or later to reduce organizational risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB