Vulnerabilities
Visual Studio Code Path Traversal Vulnerability (CVE-2026-102229) – Information Disclosure
A path traversal flaw in Visual Studio Code allows an authenticated user to read arbitrary files on the host via network requests. All versions are affected; apply the latest update or restrict network exposure.
What happened
The CVE-2026-102229 vulnerability in Visual Studio Code permits an attacker with authorized access to craft a request that bypasses the editor’s directory restrictions, enabling read access to arbitrary files on the host system. The flaw is triggered by a malformed pathname supplied over the network.
Impact
Defenders may see sensitive configuration files, credentials, or source code leaked to an external party. The attack requires the victim to be running a vulnerable instance of VS Code and to have network connectivity to the target.
What to do
- Upgrade to the latest Visual Studio Code release (check the official download page or update channel).
- If an update is not immediately available, isolate the VS Code process from untrusted networks or use firewall rules to block inbound connections to the editor’s listening ports.
- Audit logs for anomalous file read requests and verify that no unauthorized file paths are being accessed.
- Implement least‑privilege permissions for the user account running VS Code to limit file system exposure.
Mitigation status
Microsoft has issued a patch in the 2026.10 update; ensure your environment is patched.
Related vulnerabilities
CVE-2026-102231: Visual Studio Code Path Equivalence Bypass Vulnerability
A local security feature in Visual Studio Code can be bypassed due to improper path equivalence resolution, allowing attackers to gain unauthorized access to protected resources. The flaw affects all installations that rely on the feature, and defenders should update to the latest version and verify path handling.
Read briefing
CVE-2026-69370: Visual Studio Code Remote Code Execution via Command Injection
A command injection flaw in Visual Studio Code enables attackers to execute arbitrary code remotely. All versions that accept untrusted input in the command execution path are affected. Defenders should apply the latest update and audit remote access settings.
Read briefing
CVE-2026-96234: .NET 11.0 Information Disclosure Fixed – Verify Your Installations
Microsoft has confirmed that the CVE-2026-96234 information‑disclosure flaw in .NET 11.0 has been addressed in the current releases. The recent security update table now includes KB article links for .NET 11.0 and Visual Studio, but the underlying fixed builds remain unchanged. Defenders should verify that their environments run the patched versions and review the KB documentation.
Read briefing
Visual Studio Code CVE‑2026‑81357: Security Feature Bypass Vulnerability
Microsoft has disclosed CVE‑2026‑81357, a flaw in Visual Studio Code that allows attackers to bypass a built‑in security feature. The vulnerability could enable malicious code execution or privilege escalation. Defenders should verify their VS Code version and apply the latest update immediately.
Read briefing