---
id: "CVE-2026-119983"
page: "https://infrastack.ai/live/CVE-2026-119983"
kind: "vulnerability"
aliases: ["CVE-2026-119983"]
title: "Visual Studio Code: server-side request forgery lets a network attacker bypass a security feature (fixed in 1.145.3)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Visual Studio Code", "fixed": ["1.145.3"], "affected": "< 1.145.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["developer-tooling", "other", "ssrf", "visual-studio-code"]
not_affected_if: []
published_at: "2026-11-10T19:20:23+00:00"
first_seen_at: "2026-11-10T19:25:06+00:00"
updated_at: "2026-11-10T22:11:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119983", "first_seen_at": "2026-11-10T19:25:06+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-119983", "first_seen_at": "2026-11-10T22:11:09+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-119983", "https://nvd.nist.gov/vuln/detail/CVE-2026-119983"]}]
exploit_sources: []
---

# Visual Studio Code: server-side request forgery lets a network attacker bypass a security feature (fixed in 1.145.3)

Link for people: https://infrastack.ai/live/CVE-2026-119983 (this .md is for agents)

Microsoft's CVE record (CWE-918, CVSS 8.8, user interaction required) says VS Code versions before 1.145.3 have an SSRF flaw that lets an unauthorized attacker bypass a security feature over the network. Which feature is bypassed is not stated in any source I could read. The MSRC page needs JavaScript and returned nothing. The microsoft/vscode GitHub advisories published on 10 Nov 2026 do not name this CVE. No exploitation or public proof of concept is known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Visual Studio Code affected < 1.145.3 fixed 1.145.3

## How to check

Run 'code --version' and compare with 1.145.3. Versions below it are in the affected range per the CVE record as mirrored by OpenCVE. Microsoft's own advisory is not yet read, so this range is unconfirmed.

## Fix

Update VS Code to 1.145.3 or later (from the CVE record via OpenCVE; not yet confirmed on a Microsoft page).

## Timeline

- 2026-11-10T19:25:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119983
- 2026-11-10T22:11:09+00:00 analyst https://app.opencve.io/cve/CVE-2026-119983 — NVD page is empty. Affected range and fix 1.145.3 come from OpenCVE and OffSeq mirrors of the CVE record. MSRC page is JS-only and the GitHub advisories do not map to this CVE, so nothing is verified. Open: read the MSRC page for the bypassed feature.

## Documents

- [describes] OpenCVE: CVE-2026-119983 (mirrors CVE record: affected < 1.145.3) https://app.opencve.io/cve/CVE-2026-119983
- [mentions] NVD CVE-2026-119983 https://nvd.nist.gov/vuln/detail/CVE-2026-119983

## From the sources

Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_