Incomplete List of Disallowed Inputs in Visual Studio Code - CVE-2026-121663
Published: November 11, 2026
Vulnerability identifier: #VU165435
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-121663
CWE-ID: CWE-184
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass Workspace Trust protections and execute arbitrary code in the context of the user.
The vulnerability exists due to an incomplete list of disallowed inputs in Visual Studio Code's Workspace Trust protections when opening a specially crafted workspace. A remote attacker can convince a user to open such a workspace to bypass these protections and execute attacker-controlled code in the user's context.
The user does not need to grant trust to the workspace for exploitation to succeed.
Affected software
Visual Studio Code
How to mitigate CVE-2026-121663
Install security update from vendor's website.
Visual Studio Code - update to 1.145.3