Incomplete List of Disallowed Inputs in Visual Studio Code - CVE-2026-121661
Published: November 11, 2026
Vulnerability identifier: #VU165433
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121661
CWE-ID: CWE-184
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass Visual Studio Code's Workspace Trust protections and apply settings that should be blocked in an untrusted workspace.
The vulnerability exists due to an incomplete list of disallowed inputs in Visual Studio Code's Workspace Trust protections when processing workspace settings. A remote attacker can trick a user into opening an attacker-controlled workspace to apply settings that should be blocked by those protections.
Affected software
Visual Studio Code
How to mitigate CVE-2026-121661
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3