EUVD-2026-56304
GHSA-432h-4h4q-x6r2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network vector and PR:N confirmed by missing authorization on a network endpoint; UI:R reflects mandatory victim interaction; full C/I/A:H consistent with arbitrary code execution in developer context.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check (CWE-862) on a network-accessible code path, allowing an unauthenticated network attacker to execute arbitrary code on a victim's machine with high impact across confidentiality, integrity, and availability. Exploitation requires user interaction (CVSS UI:R), meaning the victim must engage with attacker-controlled content. A vendor-released patch is available in version 1.132.1; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Technical ContextAI
CWE-862 (Missing Authorization) denotes a failure to verify whether a requesting entity is permitted to perform an action - distinct from authentication (identity verification). In Visual Studio Code, a broadly capable IDE with extensive network-facing functionality (Remote Development extensions, Language Server Protocol endpoints, live share, extension APIs), this flaw resides in a network-reachable code path that omits an authorization gate entirely. The tag 'Authentication Bypass' from EUVD-2026-56304 suggests the missing check can be exploited to bypass the expected access-control flow without holding any VS Code session credentials. The CVSS vector AV:N/PR:N confirms the vulnerable endpoint is reachable over the network without any prior privilege, while UI:R indicates the victim's interaction (e.g., opening a workspace, clicking a link, or loading malicious content) is required to trigger execution.
RemediationAI
Upgrade Visual Studio Code to version 1.132.1 or later, which contains the vendor-released patch as confirmed by EUVD EUVD-2026-56304 and the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59113. Organizations unable to patch immediately should consider disabling VS Code remote development extensions (Remote SSH, Remote Containers, Remote WSL, Live Share) as a compensating control, since these represent the most likely attack surface for network-based missing-authorization exploitation - note that disabling them will break remote development workflows. Additionally, restricting outbound and inbound network access for developer workstations to known-good endpoints via host-based firewall rules can reduce exposure, though this does not eliminate the vulnerability. User awareness to avoid opening untrusted VS Code workspaces, links, or extension content provides a supplemental layer given the UI:R requirement.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today