Incorrect authorization in Visual Studio Code - CVE-2026-102232
Published: October 13, 2026
Vulnerability identifier: #VU154282
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102232
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass a security feature and execute commands in the context of the user.
The vulnerability exists due to incorrect authorization in Visual Studio Code's AI coding agent when processing attacker-controlled content. A remote attacker can supply specially crafted content that causes a configured lifecycle-hook file to be modified without the expected confirmation to bypass a security feature and execute commands in the context of the user.
User interaction is required to run the agent. Exploitation requires multiple steps involving prompt injection, Copilot Agent interaction, and triggering a build.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102232
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1