Improper Resolution of Path Equivalence in Visual Studio Code - CVE-2026-102231
Published: October 13, 2026
Vulnerability identifier: #VU154281
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102231
CWE-ID: CWE-41
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass Workspace Trust and execute commands or code from an untrusted workspace without the user first granting trust.
The vulnerability exists due to improper resolution of path equivalence in the Visual Studio Code Workspace Trust feature when resolving workspace paths. A remote attacker can manipulate system components to trigger a specific path-equivalence condition to bypass Workspace Trust and execute commands or code from an untrusted workspace without the user first granting trust.
User interaction is required. Successful exploitation depends on environmental conditions and system configuration and is not guaranteed.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102231
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1