CVE-2026-102231: Visual Studio Code Path Equivalence Bypass Vulnerability

What happened

Microsoft’s Visual Studio Code (VS Code) had a flaw where the runtime did not correctly resolve equivalent file paths. An attacker who can influence the local file system could craft paths that the editor treats as the same resource, bypassing a security check that normally restricts access to certain files.

Impact

Any user running a vulnerable VS Code instance on a machine where the attacker can create or modify files may be able to read or execute code that should be protected. The vulnerability is local only; it does not allow remote exploitation.

Mitigation

• Upgrade VS Code to version 1.85.0 or later, where the path resolution logic has been corrected.
• Verify that the 'security feature' (e.g., workspace trust or file access restrictions) is enabled and functioning after the update.
• On systems where updates cannot be applied immediately, restrict write permissions to the directories that the editor scans for extensions and configuration files.

Additional Recommendations

Review audit logs for unexpected file access patterns and consider implementing file integrity monitoring on the directories used by VS Code. Keep the editor’s extensions up to date to avoid compounded risks.