EUVD-2026-35698
GHSA-cw93-p7fx-xgqx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
AnalysisAI
Relative path traversal in Visual Studio Code versions prior to 1.123.1 enables unauthenticated remote attackers to tamper with files outside the intended directory boundary, producing a high integrity impact with no confidentiality or availability loss. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the attack requires no privileges and is low-complexity over a network, but depends on a victim interacting with attacker-controlled content. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-23 (Relative Path Traversal) describes a failure to sanitize relative path sequences such as '../' or './' within user-controlled input before using it to construct file system paths. In Visual Studio Code, a widely deployed Electron-based IDE by Microsoft, this class of flaw can manifest in workspace or extension processing code that accepts externally-supplied path components without normalization, allowing writes to escape the intended working directory. The affected version range per EUVD is Visual Studio Code 1.0.0 through below 1.123.1. The network attack vector with user interaction suggests the vulnerability is triggered when a user opens a crafted file, workspace configuration, or remote resource within the editor rather than through an autonomous server-side code path.
RemediationAI
The primary remediation is to upgrade Visual Studio Code to version 1.123.1 or later, which addresses the relative path traversal per the vendor-released patch. The Microsoft Security Response Center advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287. As a compensating control where immediate upgrade is not feasible, restrict opening of untrusted workspaces, workspace files (.code-workspace), or repository folders from unknown sources, as user interaction is required to trigger the vulnerability - preventing exposure to untrusted content directly limits exploitation opportunity. Note that this control relies on user discipline and does not eliminate the underlying flaw. No additional workarounds were specified in vendor guidance at time of analysis.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Privilege escalation in Microsoft Visual Studio Code versions 1.0.0 through 1.119.0 allows remote unauthenticated attack
Local privilege elevation in Microsoft Visual Studio Code allows an unprivileged attacker to gain higher privileges on a
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthoriz
GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers t
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today