Incorrect authorization in Visual Studio Code - CVE-2026-119982
Published: November 11, 2026
Vulnerability identifier: #VU165395
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119982
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass the restriction limiting inline chat edits to the active document and modify other workspace files without the expected authorization or confirmation.
The vulnerability exists due to incorrect authorization in Visual Studio Code inline chat when processing specially crafted content. A remote attacker can supply content that a user processes with inline chat to cause unauthorized modifications to other workspace files.
Affected software
Visual Studio Code
How to mitigate CVE-2026-119982
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3