MSRC-CVE-2026-121661 — Visual Studio Code Security Feature Bypass Vulnerability

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What security feature could be bypassed by successfully exploiting this vulnerability?
Successful exploitation could allow an untrusted workspace to apply settings that should be blocked by Visual Studio Code's Workspace Trust protections. The user must open the attacker-controlled workspace.

Security updates
1.145.3 — https://code.visualstudio.com/updates/v1_145

Vulnerabilities 1

High 7.8

CVE-2026-121661

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Microsoft Visual Studio Code

Nov 10, 2026

Revision history

2026-11-10 #1
Information published.

References

CVE-2026-121661 Visual Studio Code Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-121661
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss