Improper Encoding or Escaping of Output in Visual Studio Code - CVE-2026-102235
Published: October 13, 2026
Vulnerability identifier: #VU154285
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102235
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper encoding or escaping of output in the Visual Studio Code integrated terminal when displaying specially crafted content. A remote attacker can cause specially crafted content to appear in the integrated terminal to execute arbitrary code.
Exploitation requires the user to click the resulting notification link. Commands execute in that user's context.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102235
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1