Microsoft Visual Studio Code: Code injection allows remote code execution

Summary

Visual Studio Code contains a code injection flaw (CWE-94) that allows an unauthenticated attacker to execute code over the network. According to the CVSS vector, user interaction is required and the impact extends beyond the editor process (scope changed). Exploitation requires a user to open crafted content, such as a file, project or link.

Affected

• Microsoft Visual Studio Code 1.0.0 to before 1.145.3 (per CVE record)
• Note: the MSRC advisory content could not be retrieved; verify against MSRC.

Fixed in

• Version 1.145.3 (per CVE record: affected versions are below 1.145.3)
• Verify the fixed build on the MSRC page.

Workaround

Unknown.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• No known exploitation, KEV listing or public proof of concept at the time of research.

Our recommendation

• Inventory all VS Code installations on Windows and macOS endpoints, including versions and auto-update status.
• Update Visual Studio Code to 1.145.3 or later as soon as possible, prioritising developer workstations and machines with access to production systems.
• Until patched, remind developers not to open untrusted projects, files or links and review installed extensions.
• Check the MSRC page and NVD daily for confirmed details.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide entry for CVE-2026-120779 msrc.microsoft.com
• MSRC Security Update Guide msrc.microsoft.com
• NVD CVE-2026-120779 CVE Map (Visual Studio Code) stack.watch
• CyStack vulnerability database: Visual Studio Code cystack.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:41.