Improper access control in Visual Studio Code - CVE-2026-120780
Published: November 11, 2026
Vulnerability identifier: #VU165414
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120780
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code with the server account's permissions.
The vulnerability exists due to improper access control in the Visual Studio Code web server when handling specially crafted links within an active, previously authenticated session. A remote attacker can convince a user with such a session to open a specially crafted link while a vulnerable older server version remains available to cause that version to run and execute arbitrary code with the server account's permissions.
Affected software
Visual Studio Code
How to mitigate CVE-2026-120780
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3