Vulnerabilities
Visual Studio Code CVE‑2026‑81357: Security Feature Bypass Vulnerability
Microsoft has disclosed CVE‑2026‑81357, a flaw in Visual Studio Code that allows attackers to bypass a built‑in security feature. The vulnerability could enable malicious code execution or privilege escalation. Defenders should verify their VS Code version and apply the latest update immediately.
What happened
Microsoft identified a flaw in Visual Studio Code that lets an attacker bypass a security mechanism built into the editor. The vulnerability is tracked as CVE‑2026‑81357 and is classified as a security feature bypass.
Impact
Attackers could potentially execute arbitrary code or elevate privileges within the VS Code environment, which may lead to broader system compromise if the editor is run with elevated rights or on a compromised machine.
Mitigation
- Verify your VS Code installation version:
code --versionor check the About dialog. - Update to the latest release (at least 1.90.0 or newer, as noted in the release notes).
- Reboot the system after the update to ensure all components are refreshed.
How to verify
After updating, run code --version again and confirm the version number matches the latest official release. No additional configuration changes are required.
Related vulnerabilities
CVE-2026-102232: Local Security Feature Bypass in Visual Studio Code
An authorization flaw in Visual Studio Code allows a local attacker to bypass a built‑in security feature. The vulnerability affects any unpatched installation. Defenders should update immediately, verify the feature is enabled, and monitor for suspicious local activity.
Read briefing
CVE-2026-102231: Visual Studio Code Path Equivalence Bypass Vulnerability
A local security feature in Visual Studio Code can be bypassed due to improper path equivalence resolution, allowing attackers to gain unauthorized access to protected resources. The flaw affects all installations that rely on the feature, and defenders should update to the latest version and verify path handling.
Read briefing
CVE-2026-96957 .NET Security Feature Bypass – Informational Update
Microsoft updated the Security Updates table with KB links for .NET 11.0 and Visual Studio, clarifying that the fixed builds remain unchanged. Defenders should confirm they run the latest patched .NET version and keep Visual Studio updated.
Read briefing
Visual Studio Code Path Traversal Vulnerability (CVE-2026-102229) – Information Disclosure
A path traversal flaw in Visual Studio Code allows an authenticated user to read arbitrary files on the host via network requests. All versions are affected; apply the latest update or restrict network exposure.
Read briefing