Path traversal in Visual Studio Code - CVE-2026-102238
Published: October 13, 2026
Vulnerability identifier: #VU154286
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102238
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute code.
The vulnerability exists due to path traversal in Visual Studio Code's path-containment checks when importing profiles or opening content or links. A remote attacker can convince a user to import a specially crafted profile or open specially crafted content or links to execute code.
Successful exploitation allows access outside intended locations, with code execution occurring in the context of the interacting user.
Affected software
Visual Studio Code
How to mitigate CVE-2026-102238
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1