Skip to content
OpenAdvisories
High MSRC-CVE-2026-102236 1 CVE

Visual Studio Code Security Feature Bypass Vulnerability

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Visual Studio Code Workspace Trust feature, allowing content from an untrusted workspace to run commands or code without the user first granting trust. See Workspace Trust for more information.

How could an attacker exploit this vulnerability?
An attacker could convince a user to open a specially crafted Visual Studio Code workspace. Successful exploitation could bypass Workspace Trust protections and allow attacker-controlled content to execute code in the context of the user. User interaction is required, but the user does not need to grant trust.

Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145

Vulnerabilities 1

  • High 8.6
    CVE-2026-102236

    Visual Studio Code Security Feature Bypass Vulnerability

    Improper restriction of rendered ui layers or frames in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Microsoft Visual Studio Code

Revision history

  1. #1

    Information published.

References