CVE-2026-102851

Visual Studio Code has a missing authorization vulnerability that allows an unauthorized attacker to execute code over a network.

Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Path traversal vulnerability in Visual Studio Code allows an authorized attacker to disclose information over a network.

A vulnerability in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network using session fixation.

Visual Studio Code has improper neutralization of script-related HTML tags, leading to basic XSS vulnerability. This allows an unauthorized attacker to execute code locally.