{"id":"CVE-2026-114171","kind":"vulnerability","aliases":["CVE-2026-114171"],"related":[],"title":"Visual Studio Code: UI misrepresentation lets a network attacker bypass a security feature (fixed in 1.145.3)","description":"User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.","summary":"Visual Studio Code versions before 1.145.3 have a UI misrepresentation flaw (CWE-451). A network attacker can bypass a security feature, and the victim has to interact (CVSS 8.8, UI:R). Microsoft has not said which feature is bypassed. Not known to be exploited.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Visual Studio Code","fixed":["1.145.3"],"affected":"< 1.145.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["developers","other","user-interaction","vs-code"],"not_affected_if":[],"how_to_check":"Run 'code --version' or open Help > About. Versions below 1.145.3 are in the affected range. Exact preconditions unknown; the CVSS vector says user interaction is required (UI:R).","fix":"Update VS Code to 1.145.3 or later (per the CVE record's affected range < 1.145.3; not confirmed on a Microsoft page). Use Help > Check for Updates.","status":"open","published_at":"2026-11-10T19:19:10+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","triaged_at":"2026-11-10T19:30:34+00:00","updated_at":"2026-11-10T23:40:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T19:30:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Visual Studio Code: UI misrepresents critical information, letting attackers bypass a security feature","impact":"medium","summary":"Visual Studio Code's user interface misrepresents critical information, so a user can be shown something other than what is actually happening. An unauthorized attacker over the network can bypass a security feature as a result.","audience":"developers","category":"other","nicknames":[],"who_cares":["vs-code","developers"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker bypasses a security feature in the editor","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected VS Code versions, the fixed release, and whether user interaction is needed.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000638,"input_tokens":4502,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and Microsoft's security update guide for affected VS Code versions, the fixed release, and whether user interaction is needed.","search":"'-114171':19A,22A '-2026':18A,21A '-451':46B '1.145.3':16A,39B '8.8':62B 'allow':89C 'attack':9A,49B,92C 'bypass':10A,51B,72B,94C 'code':3A,25A,33B,36B,88C 'critic':83C 'cve':17A,20A 'cvss':61B 'cwe':45B 'develop':26B 'exploit':77B 'featur':13A,54B,70B,97C 'fix':14A 'flaw':44B 'inform':84C 'interact':30B,60B 'interfac':79C 'known':74B 'let':6A 'microsoft':65B 'misrepresent':5A,43B,81C 'network':8A,48B,100C 'r':64B 'said':68B 'secur':12A,53B,96C 'studio':2A,24A,35B,87C 'ui':4A,42B,63B,80C 'unauthor':91C 'user':29B,78C 'user-interact':28B 'version':37B 'victim':57B 'visual':1A,23A,34B,86C 'vs':32B 'vs-code':31B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["studiocode","visualstudiocode"],"ptokens":["code","studio","visual"],"labels":["developers","high","other","userinteraction","vscode"],"campaign_type":null,"search_a":"'-114171':19A,22A '-2026':18A,21A '1.145.3':16A 'attack':9A 'bypass':10A 'code':3A,25A 'cve':17A,20A 'featur':13A 'fix':14A 'let':6A 'misrepresent':5A 'network':8A 'secur':12A 'studio':2A,24A 'ui':4A 'visual':1A,23A","search_b":"'-451':46B '1.145.3':39B '8.8':62B 'attack':49B 'bypass':51B,72B 'code':33B,36B 'cvss':61B 'cwe':45B 'develop':26B 'exploit':77B 'featur':54B,70B 'flaw':44B 'interact':30B,60B 'known':74B 'microsoft':65B 'misrepresent':43B 'network':48B 'r':64B 'said':68B 'secur':53B 'studio':35B 'ui':42B,63B 'user':29B 'user-interact':28B 'version':37B 'victim':57B 'visual':34B 'vs':32B 'vs-code':31B","search_c":"'allow':89C 'attack':92C 'bypass':94C 'code':88C 'critic':83C 'featur':97C 'inform':84C 'interfac':79C 'misrepresent':81C 'network':100C 'secur':96C 'studio':87C 'ui':80C 'unauthor':91C 'user':78C 'visual':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114171","severity":null,"published_at":"2026-11-10T19:19:10+00:00","modified_at":"2026-11-10T19:19:11+00:00","first_seen_at":"2026-11-10T19:24:44+00:00","fetched_at":"2026-11-10T19:24:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114171:3214","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114171","severity":null,"published_at":"2026-11-10T23:40:50+00:00","modified_at":"2026-11-10T23:40:50+00:00","first_seen_at":"2026-11-10T23:40:50+00:00","fetched_at":"2026-11-10T23:40:50+00:00","note":"MSRC page is JS-only and unreadable; NVD is awaiting enrichment. Affected range < 1.145.3 comes from the CVE record data shown by OpenCVE (the CNA is Microsoft), which I did not read on a Microsoft page. Nothing verified. No exploitation or PoC found. The bypassed feature and the UI misrepresentation details are not public yet.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-114171","https://app.opencve.io/cve/CVE-2026-114171"]}],"documents":[{"id":120416,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114171","title":"NVD CVE-2026-114171 (CNA: Microsoft)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120417,"url":"https://app.opencve.io/cve/CVE-2026-114171","title":"OpenCVE CVE-2026-114171 (affected < 1.145.3)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}