CVE-2026-57102

Analyzed Analyzed - Analysis Complete

Inclusion of Untrusted Functionality in Visual Studio Code

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: Microsoft Corporation

Description

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-57102

EUVD

EUVD-2026-44277

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_code	From 1.0.0 (inc) to 1.128.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in Visual Studio Code involves an attacker exploiting untrusted input to bypass a security feature. It allows unauthorized access over a network without needing special privileges.

Impact Analysis

An attacker could bypass security protections in Visual Studio Code, potentially leading to unauthorized code execution or data access. This may compromise the integrity and confidentiality of your projects.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR or HIPAA requirements for data protection and security controls.

Mitigation Strategies

Apply the latest security update from Microsoft for Visual Studio Code as soon as possible to address the security feature bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-57102. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70