Microsoft Visual Studio Code: Path traversal leading to information disclosure
Summary
A path traversal weakness in Visual Studio Code allows an authorized attacker to read information over the network. According to the upstream description, remote webview resource paths were not consistently normalized before being checked against the allowed resource roots. The attacker needs a valid low-privilege account or local session and user interaction, such as opening crafted content, and the impact is limited to confidentiality (CVSS 3.1: 6.8, medium).
Affected
- Microsoft Visual Studio Code 1.0.0 to before 1.141.1 (CNA range)
- VulDB gives up to 1.141.0; the upstream issue names 1.141.0 and earlier
Fixed in
- Microsoft Visual Studio Code 1.141.1 and later (fix commit b0240f4)
Workaround
- Unknown. No workaround was described in the sources.
- Until the update is installed, limit use of untrusted remote workspaces and extensions (general advice, not from a source).
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- EPSS about 1% (0.01056).
- CISA KEV status not verified.
Our recommendation
- Update all Visual Studio Code installations to 1.141.1 or later, prioritising developer workstations and shared development environments.
- Check whether remote development features are used and restrict untrusted workspaces and extensions until patched.
- Patch the other October 2026 Microsoft items in the same update cycle (CVE-2026-102238, CVE-2026-102231).
- Verify the final version and exposure details on the MSRC and GitHub advisory pages.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory msrc.microsoft.com
- GitHub issue microsoft/vscode 341379 github.com
- VulDB entry 418043 vuldb.com
- Tenable plugin 366207 www.tenable.com
- Strix CVE record www.strix.ai
- Vulners NVD mirror vulners.com
- Vulners MSCVE mirror vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 22:12.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.