CVE-2026-102235

8.8High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-116

Impact

Remote attackers can execute arbitrary code with the user's permissions, but it requires user interaction such as opening a malicious file or link. Network access to deliver the payload is required.

Root cause

Improper output encoding or escaping allows untrusted input to be interpreted as executable instructions.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Visual Studio Code to the latest patched release via the official Microsoft update channel or your package manager; avoid opening untrusted workspaces or links until updated.

shell

$ code --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102235

Source: nvd.nist.gov/vuln/detail/CVE-2026-102235