CVE-2026-102235: Visual Studio Code Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.

FAQ

How could an attacker exploit this vulnerability? An attacker could cause specially crafted content to appear in the Visual Studio Code integrated terminal. If the user clicks the resulting notification link, successful exploitation could allow the attacker to execute commands in the context of the user. Authentication is not required.

Affected Products (1)

Developer Tools

• Visual Studio Code

Security Updates (1)

• Release Notes

Acknowledgments

<a href="https://www.linkedin.com/in/nguyen-hoang-quoc-an-009863267/">kayiz</a> with <a href="http://lp.com.vn/">Lien Phat Technology Corporation</a>, <a href="https://x.com/talfao1">Talfao</a> with <a href="https://codespect.net/">CODESPECT</a>, dldil

Revision History

• 2026-10-13: Information published.