CVE-2026-47292: Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability

Synopsis

This is a privilege escalation vulnerability in the Visual Studio Code MSSQL Extension, caused by inclusion of functionality from an untrusted control sphere. The attack is local, requires no prior authentication, but does require the victim to take some action, such as opening a malicious file or project. Successful exploitation gives an attacker full read, write, and crash-level access to the affected system, effectively enabling local privilege escalation to a higher-privileged context. A patched-image rebuild at version 1.123.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account credentials or session token are needed; an unauthenticated local attacker can initiate the exploit.

• Victim interactionRequired

  The victim must perform an action, such as opening a malicious file or workspace, giving the attacker a social-engineering window to exploit.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or other environmental factors need to align for it to succeed.

Blast Radius

• Reads sensitive files, credentials, and secrets accessible to the elevated process on the host.
• Modifies or overwrites files and configuration owned by higher-privileged accounts.
• Crashes or disrupts the affected service or dependent processes running under the elevated context.
• Gains a foothold for further lateral movement within the host or container environment.