Advisory · CVE-2026-102238
Path traversal in Visual Studio Code can execute code from a crafted project
Visual Studio Code does not properly confine pathnames to a restricted directory, and Microsoft says an unauthorized attacker can use that to execute code over a network when a user interacts. Microsoft rates it CVSS 3.1 9.6.
- Vendor
- Microsoft
- Product
- Visual Studio Code
- Identifier / CWE
- CVE-2026-102238
CWE-22 - Action timing
- Immediate
Explain it like I’m five
Opening the wrong project folder can let files escape the folder they were supposed to stay in, and VS Code can end up running what escaped.
- 01Crafted project
An attacker prepares a project or link whose paths point outside the intended directory.
- 02User opens it
A developer opens the content in Visual Studio Code.
- 03Traversal escapes
Pathnames are not confined, so content lands or loads outside the restricted directory.
- 04Code executes
The escaped content runs in the developer's context.
What happened
Microsoft disclosed CVE-2026-102238 in its October 2026 update guide: improper limitation of a pathname to a restricted directory (CWE-22) in Visual Studio Code allows an unauthorized attacker to execute code over a network, with user interaction required and changed scope.
Microsoft’s affected data lists Visual Studio Code releases before 1.141.1 as affected, so updating to 1.141.1 or later is the stated fix.
What to do
- Inventory every Visual Studio Code deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Visual Studio Code while remediation is underway, especially for internet-facing instances.
- Review application and server logs for unexpected extensions or tasks in newly opened repositories, and files written outside workspace folders.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Developer machines hold source code and cloud credentials. Push the VS Code update through normal tooling channels and treat untrusted repositories with the usual suspicion.