Skip to content
OpenAdvisories
High MSRC-CVE-2026-54981 1 CVE

Visual Studio Code Python Extension Security Feature Bypass Vulnerability

Published Aug 11, 2026 · Updated Sep 24, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is local (AV:L) but no privileges are required (PR:N) and user interaction is required (UI:R). How could an attacker exploit this security feature bypass vulnerability?
The attack itself is carried out locally by a user with authentication to the targeted system. An attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer.

Vulnerabilities 1

  • High 7.8
    CVE-2026-54981

    Visual Studio Code Python Extension Security Feature Bypass Vulnerability

    Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

    Microsoft Python extension for Visual Studio Code

Revision history

  1. #3

    Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only.

  2. #2

    Affected software updated with new package information.

  3. #1

    Information published.

References