Cross-Site Scripting Vulnerability in Visual Studio Code by Microsoft
CVE-2026-57101

7.1HIGH

Key Information:

Vendor

Microsoft
Status
Visual Studio Code
Vendor
CVE Published:
14 July 2026

What is CVE-2026-57101?

An improper neutralization of input during web page generation in Visual Studio Code allows unauthorized users to bypass security features locally. This cross-site scripting vulnerability can expose applications to potential security risks, making it crucial for users to apply patches and updates released by Microsoft to mitigate associated threats.

Affected Version(s)

Visual Studio Code 1.0.0 < 1.128.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.