MSRC-CVE-2026-45496 — Visual Studio Code Security Feature Bypass Vulnerability

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Visual Studio Code sensitive file protections.

Security updates
1.128.1 — https://code.visualstudio.com/updates/v1_128

Vulnerabilities 1

Medium 5.5

CVE-2026-45496

Visual Studio Code Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Microsoft Visual Studio Code

Jul 14, 2026

Revision history

2026-07-14 #1
Information published.

References

CVE-2026-45496 Visual Studio Code Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45496
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss