Code Injection in Visual Studio Code - CVE-2026-120782
Published: November 11, 2026
Vulnerability identifier: #VU165415
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-120782
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass a security feature and potentially execute arbitrary code, compromising confidentiality, integrity, and availability.
The vulnerability exists due to improper control of code generation in Visual Studio Code when processing externally influenced input. A remote attacker can supply crafted input that is processed locally with user interaction to inject code and bypass a security feature, potentially enabling arbitrary code execution.
Affected software
Visual Studio Code
How to mitigate CVE-2026-120782
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3