Microsoft Visual Studio Code: Remote Code Execution
Summary
Visual Studio Code contains a command injection flaw (CWE-77) that allows an attacker to execute code on the computer where it runs. According to the research notes, exploitation requires a user to open a crafted workspace or folder, and the flaw may bypass Workspace Trust protections. The CVSS 3.1 base score is 8.6, and the issue is local rather than internet-facing.
Affected
- Microsoft Visual Studio Code from 1.0.0 before 1.145.3
Fixed in
- Microsoft Visual Studio Code 1.145.3 or later
Workaround
- No workaround is needed once the patch is applied.
- Until systems are updated, do not open untrusted repositories or workspaces.
- Keep Workspace Trust enabled and do not trust workspaces from unknown sources. Do not rely on it as the only safeguard.
Exploitation
- CISA SSVC assessment in the CVE record: exploitation none, not automatable.
- Microsoft temporal vector E:U (unproven); no public exploit code found.
- Tenable reports Microsoft's exploitability index as Exploitation More Likely.
- Strix lists KEV as No; this is a secondary source and should be verified against CISA's catalogue.
Our recommendation
- Update all Visual Studio Code installations, including portable copies, to 1.145.3 or later.
- Prioritise developer workstations with elevated rights or access to source code, secrets or CI/CD credentials.
- Enforce Workspace Trust through managed settings where possible.
- Do not open repositories or files from unknown sources.
- Monitor for unusual processes started by Visual Studio Code.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide msrc.microsoft.com
- CVE Record CVE-2026-121662 www.cve.org
- VS Code 1.145 release notes code.visualstudio.com
- VS Code Workspace Trust documentation code.visualstudio.com
- Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
- Strix CVE-2026-121662 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:11.
Original description (NVD)
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.