Skip to content
OpenAdvisories
High MSRC-CVE-2026-78461 1 CVE

Visual Studio Code Security Feature Bypass Vulnerability

Published Sep 8, 2026 · Updated Sep 8, 2026

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Visual Studio Code Workspace Trust feature, allowing content from an untrusted workspace to run commands or code without the user first granting trust. See Workspace Trust for more information.

What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability by escaping the sandbox, is the ability to read local files.

Security updates
1.136.2 — https://code.visualstudio.com/updates/v1_136

Vulnerabilities 1

  • High 7.4
    CVE-2026-78461

    Visual Studio Code Security Feature Bypass Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code

Revision history

  1. #1

    Information published.

References