EUVD-2026-56562
GHSA-hm99-pwvc-xj2r
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:N is plausible as any local user can trigger the bypass without prior elevation; UI:R reflects required user action to invoke the vulnerable code path.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Local security feature bypass in Visual Studio Code allows an attacker with local access to circumvent an authorization control, achieving high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability (CWE-693, Protection Mechanism Failure) is exploitable locally without elevated privileges but requires user interaction, making social engineering or physical access the likely delivery path. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
Visual Studio Code is Microsoft's widely-deployed open-source code editor. CWE-693 (Protection Mechanism Failure) indicates a flaw where a security control - in this case an authorization check - is either absent, incorrectly implemented, or can be bypassed entirely. The CVSS vector (AV:L) confirms the attack surface is local, meaning the vulnerability is triggered on the machine running VS Code rather than over a network. The PR:N metric indicates no prior privileges are required for the attacker to trigger the bypass, which is notable for a local authorization flaw and may suggest the affected mechanism is accessible to any local user account.
RemediationAI
Apply the patch released by Microsoft via the Visual Studio Code update mechanism or the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69278. VS Code supports automatic updates; verify the installed version matches or exceeds the fixed build listed in the advisory. As a compensating control pending patching, restrict local user access to developer workstations running VS Code, enable Workspace Trust prompts if not already active, and audit VS Code extension permissions. No exact fixed version number is available in the current intelligence data - consult the MSRC advisory directly for the confirmed patched release.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Security-feature bypass in Microsoft Visual Studio Code before 1.136.2 lets a remote, unauthenticated attacker defeat a
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary co
Authorization bypass in Visual Studio Code versions 1.0.0 through 1.136.1 allows an unauthenticated network attacker to
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today