CVE-2026-57101

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting Bypass in Visual Studio Code

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: Microsoft Corporation

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-57101

EUVD

EUVD-2026-44276

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_code	From 1.0.0 (inc) to 1.128.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a cross-site scripting (XSS) vulnerability in Visual Studio Code where improper input handling allows an attacker to bypass a security feature locally.

Detection Guidance

This vulnerability involves cross-site scripting in Visual Studio Code that bypasses a security feature locally. Detection requires checking for unusual web page generation inputs or suspicious activity in VS Code extensions or webviews. Monitor for unexpected script execution or unauthorized modifications in VS Code environments.

Impact Analysis

An unauthorized attacker could exploit this to bypass security features on your local system, potentially leading to unauthorized actions or data access.

Compliance Impact

This vulnerability may impact compliance by allowing unauthorized local access, which could lead to data breaches or unauthorized modifications, violating confidentiality requirements in standards like GDPR or HIPAA.

Mitigation Strategies

Update Visual Studio Code to the latest version as soon as a patch is available from Microsoft to address the XSS vulnerability.

Hi! I’m here to help you understand CVE-2026-57101. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70