CVE-2026-40376: Visual Studio Code Elevation of Privilege Vulnerability

Synopsis

This is an improper input validation vulnerability in Visual Studio Code that allows an unauthenticated remote attacker to elevate privileges. The exploit is reachable over a network, requires no authentication, but does need the victim to take some action, and involves high attack complexity. Successful exploitation gives the attacker full read, write, and availability impact on the affected system. A patched-image rebuild at version 1.123.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable Visual Studio Code instance over the network; this is not a locally-only accessible attack surface.

• AuthenticationNot required

  No credentials or prior account access are needed; the attacker can initiate the exploit as an unauthenticated party.

• Victim interactionRequired

  A user of the affected VS Code instance must take some action (such as opening a malicious file or following a crafted link) for the exploit to succeed.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account for race conditions, specific environmental factors, or other conditions not fully under their control.

Blast Radius

• A successful attacker reads sensitive data accessible to the VS Code process, including workspace files, stored credentials, and tokens.
• The attacker can write or modify files and configuration on the affected host with the privileges of the elevated context.
• The attacker can disrupt or crash the affected VS Code instance and potentially dependent services running in the same environment.
• Privilege elevation means the attacker may pivot beyond the initial process boundary to affect the broader host or container environment.