---
id: "CVE-2026-119981"
page: "https://infrastack.ai/live/CVE-2026-119981"
kind: "vulnerability"
aliases: ["CVE-2026-119981"]
title: "Visual Studio Code: missing authentication check lets a local user raise privileges"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["linux", "macos", "other", "visual-studio-code", "windows"]
not_affected_if: ["single-user-machine"]
published_at: "2026-11-10T19:20:23+00:00"
first_seen_at: "2026-11-10T19:25:06+00:00"
updated_at: "2026-11-10T22:10:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119981", "first_seen_at": "2026-11-10T19:25:06+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T22:10:54+00:00"}]
exploit_sources: []
---

# Visual Studio Code: missing authentication check lets a local user raise privileges

Link for people: https://infrastack.ai/live/CVE-2026-119981 (this .md is for agents)

Visual Studio Code has a critical function that does not check authentication, so an attacker who already has an account on the machine can raise their privileges. The attack runs locally and needs no internet access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Unknown until Microsoft publishes affected versions. Meanwhile check your version with 'code --version' and update VS Code to the latest stable release; read the MSRC entry for CVE-2026-119981 for the fixed build.

## Timeline

- 2026-11-10T19:25:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119981
- 2026-11-10T22:10:54+00:00 analyst — Only NVD/CNA text (secure@microsoft.com, CVSS 7.0 AV:L/AC:H/PR:L) found; MSRC page is JS-only and returned no text via web-cli, so affected versions and fixed release are unknown. No PoC or exploitation reported. Settle by reading MSRC update guide or VS Code release notes.

## From the sources

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_