CVE-2026-120779 · Other
NO FIX YET · SEE WHAT TO DO
A code injection flaw in Visual Studio Code lets an unauthorized attacker execute code over the network. The NVD entry rates it critical at CVSS 9.6.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Visual Studio Code is possibly exposed. The CVSS vector (from Microsoft) is network, no privileges, user interaction required, scope changed, so an attacker likely needs a user to open or click something crafted. Which component, setting or extension is involved is not stated in any source read; a third-party tracker says versions before 1.145.3 are affected.
Who cares desktop, developer-tooling, visual-studio-code
code --version); versions below 1.145.3 are reportedly affected per OffSeq (third-party, not confirmed by Microsoft)Reportedly update VS Code to 1.145.3 (per OffSeq; Microsoft's own page not read, so unconfirmed).
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.