EUVD-2026-35536
GHSA-rg3p-gp39-622w
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth network input handler (AV:N/PR:N/UI:N) with specialised timing/config prerequisites (AC:H) yielding full code-execution-class impact in the user's context (C:H/I:H/A:H, S:U).
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Visual Studio Code versions 1.0.0 through 1.119.0 allows remote unauthenticated attackers to elevate privileges over a network by exploiting improper input validation (CWE-20). Microsoft has released a patched build (1.119.1) and SSVC rates technical impact as total, though EPSS remains low at 0.09% with no public exploit identified at time of analysis.
Technical ContextAI
Visual Studio Code is Microsoft's cross-platform source-code editor built on the Electron framework, which combines Chromium and Node.js to execute web technologies with local OS privileges. The root cause is CWE-20 (Improper Input Validation), meaning the editor accepts data from a network-reachable surface without enforcing expected syntactic, semantic, or length constraints before passing it to a privileged operation. The single CPE microsoft:visual_studio_code:* confirms the desktop editor itself is in scope rather than a specific extension, and the 'Authentication Bypass' tag indicates the malformed input is processed before any identity check is enforced, allowing the attacker's input to reach privileged code paths intended for authenticated users.
RemediationAI
Vendor-released patch: Visual Studio Code 1.119.1 - upgrade all instances to 1.119.1 or later via the in-app auto-updater, MSI/DEB/RPM packages, or your endpoint management tool, using the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40376 as the authoritative reference. No vendor-supplied workaround is published; compensating controls until rollout completes include disabling Remote Tunnels (settings 'remote.tunnels.access') and Live Share on managed workstations to remove the externally reachable surface (trade-off: blocks remote pair programming and cloud-hosted dev workflows), restricting outbound connections from VS Code processes to known Microsoft endpoints via host firewall (may break marketplace updates if over-restricted), and requiring users to only open trusted workspaces under Workspace Trust (already default, but verify policy enforcement). Cross-reference VulDB entry https://vuldb.com/vuln/369591 for additional triage data.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Local privilege elevation in Microsoft Visual Studio Code allows an unprivileged attacker to gain higher privileges on a
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthoriz
GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers t
Visual Studio Code Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today