Improper Input Validation in Visual Studio Code Elevates Privileges

Publication date: 2026-06-09

Last updated on: 2026-06-15

Assigner: Microsoft Corporation

Description

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-15

Generated

2026-06-30

AI Q&A

2026-06-09

EPSS Evaluated

2026-06-28

NVD

CVE-2026-47281

EUVD

EUVD-2026-35573

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_code	From 1.0.0 (inc) to 1.123.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is caused by improper input validation in Visual Studio Code. It allows an unauthorized attacker to elevate their privileges over a network.

Impact Analysis

The vulnerability can have a severe impact as it enables an attacker to gain elevated privileges without authorization. This can lead to complete compromise of the affected system, including full control over confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-47281. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70