Visual Studio Code: Remote code execution due to incorrect authorization
Summary
Microsoft Visual Studio Code from 1.0.0 before 1.145.3 contains an incorrect authorization flaw (CWE-863). A remote, unauthenticated attacker can execute code over the network if a user is lured into an interaction, such as opening a crafted workspace or resource. The CVSS 3.1 base score is 8.3 (High) with a scope change and full impact on confidentiality, integrity and availability. The root cause and affected component are not described in the available sources.
Affected
- Microsoft Visual Studio Code 1.0.0 to before 1.145.3
Fixed in
- Update to Visual Studio Code 1.145.3 or later (implied by the CVE record; to be confirmed on the MSRC advisory)
Workaround
- Unknown. No vendor-published workaround found.
- Until patched: only open repositories and workspaces from trusted sources and keep Workspace Trust and Restricted Mode enabled (recommendation, not from a vendor source).
Exploitation
- CVE record: exploit code maturity unproven (E:U).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed as known exploited (KEV) in the sources reviewed.
- Public proof of concept: unknown.
Our recommendation
- Update Visual Studio Code to 1.145.3 or later on all developer workstations, after confirming the fixed build on the MSRC advisory.
- Until patched, only open untrusted repositories and workspaces with caution and keep Workspace Trust and Restricted Mode enabled.
- Inventory where VS Code is installed and which staff open external repositories or remote-development resources.
- Monitor for a public proof of concept or a KEV listing, and check the NVD entry once it is analysed.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-119985 msrc.microsoft.com
- CVE Record CVE-2026-119985 www.cve.org
- Strix: CVE-2026-119985 www.strix.ai
- ZDI: November 2026 security update review www.thezdi.com
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:23.
Original description (NVD)
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.