Cross-site scripting in Visual Studio Code - CVE-2026-119975
Published: November 11, 2026
Vulnerability identifier: #VU165392
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-119975
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code in the context of the user.
The vulnerability exists due to improper neutralization of input during web page generation in the Visual Studio Code publisher trust dialog when rendering specially crafted extension display information. A remote attacker can publish an extension with malicious display information and trick a user into clicking a malicious link in the dialog to execute arbitrary code in the context of that user.
Exploitation can occur before the extension is installed or the publisher is trusted.
Affected software
Visual Studio Code
How to mitigate CVE-2026-119975
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3