Visual Studio Code: Information disclosure due to missing authorization

Summary

Missing authorization in Microsoft Visual Studio Code allows an unauthorized attacker to disclose information over a network. The CVSS 3.1 score is 7.4 (High), with network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact. Microsoft's public description does not state the exact trigger, so the required user interaction is not confirmed in detail.

Affected

• Microsoft Visual Studio Code from 1.0.0 before 1.145.3
• Unknown: whether Insiders or remote-server builds are covered separately

Fixed in

• Update to Visual Studio Code 1.145.3 or later (according to the Microsoft release page; not yet confirmed by the MSRC advisory or a GitHub tag)

Workaround

Unknown. No vendor-documented workaround found.

Exploitation

• No evidence of exploitation in the wild found
• Not listed in CISA KEV (per secondary tracker)
• No public proof of concept found
• Exploit maturity is "Unproven" according to the CVSS temporal metrics
• CISA SSVC: exploitation none, automatable no, technical impact partial

Our recommendation

• Inventory all Visual Studio Code installations, including remote-server components
• Update to 1.145.3 or later once the MSRC advisory confirms the fixed version
• Check whether developer workstations run older builds, as they often hold source code and credentials
• Verify details on the MSRC advisory before acting

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-102230 msrc.microsoft.com
• CVE.org record CVE-2026-102230 www.cve.org
• Visual Studio Code 1.145 release notes code.visualstudio.com
• GitHub microsoft/vscode releases github.com
• Strix CVE-2026-102230 summary www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:24.