CVE-2026-48569: Visual Studio Code Security Feature Bypass Vulnerability

Synopsis

A security feature bypass vulnerability exists in Visual Studio Code due to improper input validation. The attack is local, requires no prior authentication, but does need the victim to open a malicious file or take a similar action; a CVSS v3.1 score of 7.1 (High) reflects the scoped, cross-boundary impact. Successful exploitation allows an attacker to read sensitive data from outside the expected security boundary and make limited modifications, though it does not disrupt availability. A patched-image rebuild at version 1.123.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to reach the vulnerable component.

• AuthenticationNot required

  No account or credentials are required before exploitation; the attacker can proceed without prior authentication.

• Victim interactionRequired

  A victim must take an action, such as opening a malicious file or project, for the exploit to execute.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or specific memory layout requirements must be met.

Blast Radius

• A successful attacker reads sensitive data from outside the security scope that Visual Studio Code is intended to enforce, including files or tokens the process should not be able to access.
• The attacker can make limited modifications to data within the broader scope, though write access is constrained.
• Service availability is not affected; the running editor or host process remains operational after exploitation.
• Because the vulnerability has a Changed scope (S:C), impact can extend beyond the immediate VS Code process to other components or data on the same host.