{"id":"CVE-2026-119976","kind":"vulnerability","aliases":["CVE-2026-119976"],"related":[],"title":"VS Code GitHub Pull Requests extension: path control lets attackers read information","description":"External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.","summary":"The GitHub Pull Requests and Issues extension for Visual Studio Code lets an attacker control a file name or path it uses. An unauthorized attacker over the network can use this to disclose information.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["github-pull-requests-extension","package","vscode"],"not_affected_if":[],"how_to_check":"- Check whether the `GitHub Pull Requests and Issues` extension is installed in Visual Studio Code and note its version.\n- Compare the installed version against the ranges in the vendor's advisory: unknown","fix":null,"status":"open","published_at":"2026-11-10T19:20:22+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","triaged_at":"2026-11-10T19:56:23+00:00","updated_at":"2026-11-10T19:56:23+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-10T19:56:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"VS Code GitHub Pull Requests extension: path control lets attackers read information","impact":"low","summary":"The GitHub Pull Requests and Issues extension for Visual Studio Code lets an attacker control a file name or path it uses. An unauthorized attacker over the network can use this to disclose information.","audience":"developers","category":"package","nicknames":[],"who_cares":["vscode","github-pull-requests-extension"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads information the extension can access over the network","analyst_note":"Find the vendor advisory or CVE record for the affected and fixed extension versions, required settings, and whether user interaction is needed.","how_to_check":"- Check whether the `GitHub Pull Requests and Issues` extension is installed in Visual Studio Code and note its version.\n- Compare the installed version against the ranges in the vendor's advisory: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Developers who use the GitHub Pull Requests and Issues extension in Visual Studio Code are the likely exposure. The sources do not state which versions are affected or what configuration is required. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4508,"output_tokens":479,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119976':15A,18A '-2026':14A,17A 'allow':77C 'attack':10A,39B,50B,80C 'code':2A,36B,70C 'control':8A,40B,61C 'cve':13A,16A 'disclos':58B,82C 'extens':6A,23B,32B,76C 'extern':60C 'file':42B,63C 'github':3A,20B,27B,71C 'github-pull-requests-extens':19B 'inform':12A,59B,83C 'issu':31B,75C 'let':9A,37B 'name':43B,64C 'network':53B,86C 'packag':24B 'path':7A,45B,66C 'pull':4A,21B,28B,72C 'read':11A 'request':5A,22B,29B,73C 'studio':35B,69C 'unauthor':49B,79C 'use':47B,55B 'visual':34B,68C 'vs':1A 'vscode':25B","nicknames":[],"mitigations":[],"who_affected":"Developers who use the GitHub Pull Requests and Issues extension in Visual Studio Code are the likely exposure. The sources do not state which versions are affected or what configuration is required. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["githubpullrequestsextension","medium","package","vscode"],"campaign_type":null,"search_a":"'-119976':15A,18A '-2026':14A,17A 'attack':10A 'code':2A 'control':8A 'cve':13A,16A 'extens':6A 'github':3A 'inform':12A 'let':9A 'path':7A 'pull':4A 'read':11A 'request':5A 'vs':1A","search_b":"'attack':39B,50B 'code':36B 'control':40B 'disclos':58B 'extens':23B,32B 'file':42B 'github':20B,27B 'github-pull-requests-extens':19B 'inform':59B 'issu':31B 'let':37B 'name':43B 'network':53B 'packag':24B 'path':45B 'pull':21B,28B 'request':22B,29B 'studio':35B 'unauthor':49B 'use':47B,55B 'visual':34B 'vscode':25B","search_c":"'allow':77C 'attack':80C 'code':70C 'control':61C 'disclos':82C 'extens':76C 'extern':60C 'file':63C 'github':71C 'inform':83C 'issu':75C 'name':64C 'network':86C 'path':66C 'pull':72C 'request':73C 'studio':69C 'unauthor':79C 'visual':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119976","severity":null,"published_at":"2026-11-10T19:20:22+00:00","modified_at":"2026-11-10T19:20:22+00:00","first_seen_at":"2026-11-10T19:25:06+00:00","fetched_at":"2026-11-10T19:25:06+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}