CVE-2026-102238

9.6Critical

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

9.6Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-22

Impact

Remote attackers can execute arbitrary code on a developer's workstation if they convince the user to open a malicious link or project file. This requires network delivery and user interaction.

Root cause

Visual Studio Code fails to properly sanitize pathnames, allowing path traversal outside the restricted working directory.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade Visual Studio Code to the patched release referenced in the Microsoft Security Response Center advisory; until patched, avoid opening untrusted workspaces or following untrusted URI schemes.

shell

$ code --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102238

Source: nvd.nist.gov/vuln/detail/CVE-2026-102238