Visual Studio Code: Security feature bypass due to incomplete input filtering

Summary

Visual Studio Code contains a security feature bypass caused by an incomplete list of disallowed inputs (CWE-184). The record does not name the affected security feature. An unauthorized attacker can exploit this over a network to bypass the protection, with a CVSS 3.1 score of 7.5. Exploitation requires high attack complexity and user interaction, such as opening crafted content.

Affected

• Microsoft Visual Studio Code from 1.0.0 before 1.145.3

Fixed in

• Update to Visual Studio Code 1.145.3 or later (according to the CNA version range)
• The release notes for 1.145.3 do not name this CVE, so the mapping rests on the CNA range. Check the MSRC advisory for confirmation.
• Verify the installed build from the official Microsoft channel. Do not rely on 1.145.2 alone.

Workaround

• Unknown. No vendor-published workaround is known for this CVE. Apply the update.

Exploitation

• Microsoft exploitability index: Exploitation Less Likely, public disclosure not marked (Rapid7).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in CISA KEV. No in-the-wild exploitation reported.
• No public proof of concept known.

Our recommendation

• Update all Visual Studio Code installations to 1.145.3 or later, prioritising developer and administrator workstations.
• Use managed deployment or policy where available, and check installed versions in your inventory.
• Re-check the MSRC advisory for details on the affected security feature and further guidance.
• Patch all VS Code bugs published on the same day in the same cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-121660 www.cve.org
• Microsoft Security Update Guide CVE-2026-121660 msrc.microsoft.com
• VS Code Release Notes 1.145 code.visualstudio.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Strix CVE-2026-121660 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:21.