Path traversal in Microsoft Visual Studio Code enables remote code execution

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

• Microsoft Visual Studio Code: affected starting at 1.0.0 and for all versions < 1.141.1, according to the structured affected data.
• 1.141.1 is the boundary that the structured data places outside the affected range. The record does not establish the status of parallel product branches or other release channels beyond this range.

Microsoft Visual Studio Code improperly limits a pathname to a restricted directory. A crafted pathname may escape the intended directory boundary, allowing access to or processing of resources outside the permitted location and potentially leading to code execution. The record states that the attack can be reached over a network, requires no prior privileges, has low complexity, and requires user interaction. The specific pathname-handling component, endpoint, and affected filesystem operation are not identified in the available evidence.

The record describes a network-reachable attack by an unauthorized attacker that requires no prior authentication or privileges, has low complexity, and requires user interaction. A related advisory summary describes that interaction in the context of opening a malicious repository, but the primary record does not identify the exact endpoint or operation sequence. No public exploit is recorded in the supplied data, and the available coordination status marks exploitation as none. This does not prove that exploitation is impossible or absent from every environment.

The vulnerability can lead to remote code execution after the required user interaction occurs. The attack is network-reachable, requires no prior privileges, and has changed scope, so the consequences may extend beyond an invalid pathname and affect security boundaries around the development environment. Possible technical outcomes include disclosure of data, modification of content or configuration, and disruption of the affected system. The record does not establish operating-system privilege escalation, persistence, or lateral movement.

Successful exploitation could allow code execution in the context of Visual Studio Code, potentially affecting the confidentiality, integrity, and availability of the development environment. Possible consequences include access to or modification of local data, interference with development activity, and disruption of the affected workstation or related workflow. The record does not establish a specific breach, victim, data theft event, or spread to other systems. Actual impact depends on the process privileges and data available on the targeted system.

1. Update Microsoft Visual Studio Code to 1.141.1, which the structured affected data places outside the affected range.
2. Verify after deployment that every actual installation has reached the target version, including developer workstations, build hosts, and centrally managed devices.
3. Until updating is possible, restrict the opening of untrusted repositories or network-delivered content as a temporary exposure-reduction measure. This is defense-in-depth, not a vendor-confirmed workaround.
4. Review any separate release branches or distribution channels used by the organization, because the available record does not establish the status of every parallel branch.

1. Inventory all Microsoft Visual Studio Code installations on developer workstations, build hosts, and systems that process repositories or other network-delivered content.
2. Compare installed versions with the affected and remediation boundaries; do not treat normal application operation as evidence that a system is safe.
3. Review workflows in which users open repositories, workspaces, or untrusted content from network sources, because this is the user interaction described by the related advisory summary.
4. As a precautionary monitoring measure, review endpoint telemetry for unexpected process creation by Visual Studio Code near suspicious interactions with untrusted content. No specific IOC or log event is provided, and the absence of suspicious logs does not prove that a system was not affected.