Use of Incorrectly-Resolved Name or Reference in Visual Studio Code - CVE-2026-81383
Published: September 9, 2026
Vulnerability identifier: #VU148277
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-81383
CWE-ID: CWE-706
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose file contents.
The vulnerability exists due to use of an incorrectly resolved name or reference in Visual Studio Code when resolving names or references. A remote attacker can exploit an incorrectly resolved name or reference to disclose file contents.
User interaction is required. The accessible file content depends on the privileges of the compromised user.
Affected software
Visual Studio Code
How to mitigate CVE-2026-81383
Install security update from vendor's website.
Visual Studio Code - update to 1.136.2