---
id: "CVE-2026-119985"
page: "https://infrastack.ai/live/CVE-2026-119985"
kind: "vulnerability"
aliases: ["CVE-2026-119985"]
title: "Visual Studio Code: incorrect authorization lets a network attacker run code"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Visual Studio Code", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["developers", "other", "visual-studio-code"]
not_affected_if: []
published_at: "2026-11-10T19:20:23+00:00"
first_seen_at: "2026-11-10T19:25:06+00:00"
updated_at: "2026-11-10T19:34:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119985", "first_seen_at": "2026-11-10T19:25:06+00:00"}]
exploit_sources: []
---

# Visual Studio Code: incorrect authorization lets a network attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-119985 (this .md is for agents)

Visual Studio Code has an incorrect authorization flaw that lets an unauthenticated attacker run code over the network. The sources do not say which component or configuration is involved.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Visual Studio Code affected range not listed fixed no fixed version listed

## How to check

- Check the installed Visual Studio Code version with `code --version` and compare it against the fixed release, if one is named.

## Fix

- Visual Studio Code: unknown

## Timeline

- 2026-11-10T19:25:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119985

## From the sources

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_