Spoofing attack in Visual Studio Code - CVE-2026-114171
Published: November 11, 2026
Vulnerability identifier: #VU164972
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114171
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass a security feature and execute code with the victim user's permissions.
The vulnerability exists due to user interface misrepresentation of critical information in the Visual Studio Code MCP server installation preview when handling a specially crafted installation link. A remote attacker can convince a user to install an MCP server through the link while the preview omits security-relevant details, allowing the installed server to execute code with the user's permissions.
Affected software
Visual Studio Code
How to mitigate CVE-2026-114171
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3