MSRC-CVE-2026-120779 — Visual Studio Code Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An unauthenticated attacker who controls a remote MCP server could convince a user to connect Visual Studio Code to that server and click a specially crafted link in a notification. Successful exploitation could allow the attacker to execute code with the user's permissions.

Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145

Vulnerabilities 1

Critical 9.6

CVE-2026-120779

Visual Studio Code Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Microsoft Visual Studio Code

Nov 10, 2026

Revision history

2026-11-10 #1
Information published.

References

CVE-2026-120779 Visual Studio Code Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120779
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss