SB20261110350 - Multiple vulnerabilities in Visual Studio Code

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-102230)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose file content over a network.

The vulnerability exists due to missing authorization in Visual Studio Code when handling access to file content. A remote attacker can exploit the missing authorization checks, with user interaction, to access file content without authorization over a network.

2) Improper Restriction of Rendered UI Layers or Frames (CVE-ID: CVE-2026-102236)

CWE-ID: CWE-1021 - Improper Restriction of Rendered UI Layers or Frames

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass Visual Studio Code Workspace Trust protections and execute arbitrary code in the context of the user.

The vulnerability exists due to improper restriction of rendered UI layers or frames in Visual Studio Code when opening a specially crafted workspace. A remote attacker can convince a user to open such a workspace to execute attacker-controlled commands or code without the user first granting trust.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102230
• https://code.visualstudio.com/updates/v1_145
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102236