CVE-2026-47281: Visual Studio Code Elevation of Privilege Vulnerability

Synopsis

An improper input validation vulnerability in Visual Studio Code allows an unauthenticated remote attacker to elevate privileges by reaching the affected application over a network connection. A victim must take some action, such as opening a malicious file or workspace, for exploitation to succeed. Successful exploitation gives the attacker high-level access to confidentiality, integrity, and availability across the affected scope, enabling data theft, file modification, and service disruption. A patched-image rebuild at version 1.123.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Visual Studio Code instance over the network; local-only deployments with no external exposure reduce but do not eliminate risk from lateral movement.

• AuthenticationNot required

  No credentials or existing account are needed - the attacker can initiate the exploit as an anonymous, unauthenticated party.

• Victim interactionRequired

  A user must perform an action, such as opening a crafted file, workspace, or following a malicious link, for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• Attacker reads sensitive files and data accessible within the affected scope, including credentials, tokens, and configuration files.
• Attacker writes or modifies files and settings on the compromised system, enabling persistence or further lateral movement.
• Attacker disrupts or terminates the affected service, causing availability loss for any workload depending on the Visual Studio Code instance.
• Because the scope is changed (S:C), impact can extend beyond the immediate VS Code process to other components or containers sharing the same host or trust boundary.