Visual Studio Code EUVD-2026-35502

Exploitation requires the victim to open attacker-controlled content (a repository, folder, workspace file, or project) in Visual Studio Code on their local machine - this is the UI:R user interaction baked into the CVSS vector. Limiting factors: the attacker must first deliver the malicious project to the developer (phishing, supply-chain repo, malicious clone link); the user must actually open it in VS Code rather than just downloading it; and if Workspace Trust is enabled and the folder is opened in Restricted Mode, many code-execution surfaces (tasks, debug configs, most extensions) are blocked, materially raising the bar. Authentication requirements not confirmed from available data beyond CVSS PR:N, which here means no prior privileges on the VS Code process are needed by the attacker.

The CVSS vector AV:L/AC:L/PR:N/UI:R paints a clear picture: exploitation needs local context and user interaction (typically opening a malicious folder or file in VS Code), but no prior authentication on the target process and low attack complexity, with high CIA impact yielding a 7.8 base score. There is no EPSS score, no KEV listing, no public POC reference, and only a single MSRC advisory pointer in the provided data, suggesting this is currently a vendor-disclosed issue without observed in-the-wild abuse. The MSRC label 'elevate privileges locally' is somewhat in tension with the typical VS Code threat model (code execution as the current user rather than EoP to SYSTEM) - the precise privilege boundary crossed is not documented in the provided data and should be confirmed against the MSRC advisory before treating this as a SYSTEM-level EoP. Realistic priority is moderate-to-high for developer fleets given VS Code's massive install base and the common 'clone-and-open' workflow that satisfies the UI:R prerequisite.

An attacker publishes a booby-trapped repository (or sends a ZIP via phishing) containing crafted workspace metadata, tasks, or extension references; when a developer clones the repo and opens it in Visual Studio Code, the editor loads functionality from the attacker-controlled location and executes attacker code under the developer's account. From there the adversary can steal SSH keys, cloud credentials, source code, and pivot into CI/CD systems - no public POC has been identified in the provided data.