Assessment
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- Severity
- Important
- CVSS base score
- 7.8
- Impact
- Security Feature Bypass
- Exploitation detected
- No known exploitation (MSRC assessment)
- Exploitability
- Exploitation Less Likely
- Publicly disclosed
- No (MSRC assessment)
- EPSS · 30-day forecast
- No EPSS score collected
- Customer action
- Required: follow the MSRC remediation guidance
More details
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Public detection template
- No Nuclei template is listed in the current collected catalog
- Component
- Visual Studio Code
- Weakness
- CWE-184: Incomplete List of Disallowed Inputs
- Issued by
- Microsoft
- Last revised
- 10 Nov 2026
CVSS 3.1 base metricsRed raises the risk · green lowers it
- Attack vector
- LocalAV:L
- Attack complexity
- LowAC:L
- Privileges required
- NonePR:N
- User interaction
- RequiredUI:R
- Scope
- UnchangedS:U
- Confidentiality
- HighC:H
- Integrity
- HighI:H
- Availability
- HighA:H
Updates that fix it
0 KBsNo KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Developer Tools
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this versionField-level log (0)
Up to 100 recent field edits are shown; older edits may be outside retention.
No retained field changes for this selection.