CVE-2026-58650: Visual Studio Code Security Feature Bypass Vulnerability

Overview

Severity
High (CVSS 7.8)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2026-Aug
Released
2026-08-11

Description

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

FAQ

What security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass the Visual Studio Code Workspace Trust feature, allowing content from an untrusted workspace to run commands or code without the user first granting trust. See Workspace Trust for more information.

Affected Products (1)

Developer Tools

  • Visual Studio Code

Security Updates (1)

Acknowledgments

<a href="https://github.com/samer666569">陳宥升 (CheN..)</a>

Revision History

  • 2026-08-11: Information published.