External Control of File Name or Path in Visual Studio Code - CVE-2026-119976
Published: November 11, 2026
Vulnerability identifier: #VU165393
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119976
CWE-ID: CWE-73
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information, including NetNTLMv2 hashes, over a network.
The vulnerability exists due to external control of file names or paths in the Visual Studio Code GitHub Pull Requests and Issues Extension when processing externally supplied file names or paths. A remote attacker can supply a crafted file name or path to disclose NetNTLMv2 hashes over a network with user interaction.
Affected software
Visual Studio Code
How to mitigate CVE-2026-119976
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3