Visual Studio Code: Cross-Site Scripting (XSS)

Summary

Microsoft's CVE record describes a Cross-Site Scripting weakness (CWE-79) in Visual Studio Code, although the record title refers to Remote Code Execution. An unauthenticated attacker on the network could execute code, but the attack needs high complexity and user interaction. The CVSS score is 8.3 with changed scope, so the impact may extend beyond the editor. No exploitation has been reported to our knowledge.

Affected

• Microsoft Visual Studio Code 1.0.0 to before 1.145.3

Fixed in

• Visual Studio Code 1.145.3 or later (not yet confirmed against the MSRC advisory)

Workaround

• No vendor-stated workaround known.
• Unknown whether any configuration setting reduces exposure.

Exploitation

• CISA SSVC: exploitation none, automatable no.
• No public proof of concept or in-the-wild exploitation found in limited searches.
• Not listed in KEV according to the Strix tracker.

Our recommendation

• Open the MSRC advisory and confirm the fixed build number and any workarounds.
• Update developer installations to 1.145.3 or later, including portable and managed copies.
• Recheck NVD and the MSRC advisory in a few days for exploitation updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-121664 www.cve.org
• MSRC Security Update Guide CVE-2026-121664 msrc.microsoft.com
• VS Code 1.145 release notes code.visualstudio.com
• Strix CVE tracker CVE-2026-121664 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:22.