PatchaPalooza

CVE-2026-120782: Visual Studio Code Security Feature Bypass Vulnerability

CVE-2026-120782 is a security feature bypass vulnerability in Visual Studio Code, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 1 product in 1 product family (Developer Tools).

Key facts

CVE ID
CVE-2026-120782
Severity
High CVSS 7.8
Microsoft severity
Important
Impact
Security Feature Bypass
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-94; CWE-863
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Developer Tools

CVSS score and vector

Microsoft scores CVE-2026-120782 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Affected products (1)

Developer Tools

ProductSecurity updateTypeFixed buildRestart
Visual Studio CodeRelease NotesSecurity Update1.145.3

NIST NVD data

NVD status
Awaiting Analysis
NVD CVSS
7.8 (HIGH)
NVD weakness
CWE-94; CWE-863
Published to NVD
NVD last modified

References

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.

Sources