Missing Authorization in Visual Studio Code - CVE-2026-70098
Published: October 14, 2026
Vulnerability identifier: #VU154557
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70098
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to missing authorization in Visual Studio Code Workspace Trust protections when opening a specially crafted workspace. A remote attacker can convince a user to open a specially crafted workspace to execute arbitrary code in the context of the user.
The user does not need to grant trust to the workspace for exploitation to succeed.
Affected software
Visual Studio Code
How to mitigate CVE-2026-70098
Install security update from vendor's website.
Visual Studio Code - update to 1.141.1