Skip to content
OpenAdvisories
High MSRC-CVE-2026-59113 1 CVE

Visual Studio Code Remote Code Execution Vulnerability

Published Aug 11, 2026 · Updated Sep 24, 2026 · Revision 3

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could host a specially crafted web page and use social engineering to convince a user to have the application retrieve it. The malicious page could then cause the application to launch operating-system protocol handlers without prompting the user, which could result in code execution on the user's system. User interaction is required.

Security updates
1.132.1 — https://code.visualstudio.com/updates/v1_132

Vulnerabilities 1

  • High 8.8
    CVE-2026-59113

    Visual Studio Code Remote Code Execution Vulnerability

    Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Microsoft Visual Studio Code

Revision history

  1. #3

    Updated the fixed version information and download link. The fix was previously believed to be included in Dynamics 365 Server (on-premises) version 6.2; however, it has been confirmed that the fix is included in Dynamics 365 Server v9.1 (on-premises) Update 1.45 (version 9.1.0045.0011). The download link, release notes, and build number has been updated accordingly in the Security Updates table. This is an informational change only.

  2. #2

    Affected software updated with new package information.

  3. #1

    Information published.

References