CVE-2026-41612: Visual Studio Code Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 5.5)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-May
Released
2026-05-12

Description

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

FAQ

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes unauthorized access to the file system, specifically file path information. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of this vulnerability requires that a user trigger the payload in the application.

Affected Products (1)

Developer Tools

  • Visual Studio Code - Live Preview extension

Security Updates (1)

Acknowledgments

<a href="https://www.linkedin.com/in/aastikgakhar/">Aastik Gakhar</a>

Revision History

  • 2026-05-12: Information published.