Missing Authorization in Visual Studio Code - CVE-2026-102233
Published: October 13, 2026
Vulnerability identifier: #VU154283
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102233
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass the Workspace Trust security feature.
The vulnerability exists due to missing authorization in the Visual Studio Code Workspace Trust feature when processing untrusted workspace content locally. A remote attacker can cause untrusted workspace content to run commands or code without the user first granting trust to bypass the Workspace Trust security feature.
Exploitation requires user interaction.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102233
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1