Missing Authentication for Critical Function in Visual Studio Code - CVE-2026-119981
Published: November 11, 2026
Vulnerability identifier: #VU165394
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119981
CWE-ID: CWE-306
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to elevate privileges and execute code in the context of another Visual Studio Code user on the vulnerable system.
The vulnerability exists due to missing authentication for a critical function in Visual Studio Code when critical functionality is invoked locally. A local user can invoke the affected functionality without the required authentication to execute code in the context of another Visual Studio Code user.
Affected software
Visual Studio Code
How to mitigate CVE-2026-119981
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3