{"id":"CVE-2026-70094","kind":"vulnerability","aliases":["CVE-2026-70094"],"related":[],"title":"Visual Studio Code: untrusted search path lets a network attacker run code","description":"Untrusted search path in Visual Studio Code allows an unauthorized attacker to execute code over a network.","summary":"Visual Studio Code loads a program or library from an untrusted search path, so a file an attacker controls can be run in its place. The sources say an unauthorized attacker can execute code over a network.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Visual Studio Code","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["developers","other","vscode"],"not_affected_if":[],"how_to_check":"- Check the installed Visual Studio Code version with `code --version` and compare it with the fixed version, which the sources do not name.","fix":null,"status":"open","published_at":"2026-11-10T19:21:20+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","triaged_at":"2026-11-10T19:26:05+00:00","updated_at":"2026-11-10T19:26:05+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T19:26:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Visual Studio Code: untrusted search path lets a network attacker run code","impact":"high","summary":"Visual Studio Code loads a program or library from an untrusted search path, so a file an attacker controls can be run in its place. The sources say an unauthorized attacker can execute code over a network.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vscode","developers"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker runs code on the developer's machine over the network","analyst_note":"Find the vendor advisory and the fixed version, and confirm which search path and conditions are needed (NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70094).","how_to_check":"- Check the installed Visual Studio Code version with `code --version` and compare it with the fixed version, which the sources do not name.\n- unknown","plain_action":"","product_name":"Visual Studio Code","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4484,"output_tokens":433,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find the vendor advisory and the fixed version, and confirm which search path and conditions are needed (NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-70094).","search":"'-2026':14A,17A '-70094':15A,18A 'allow':69C 'attack':10A,42B,55B,72C 'code':3A,12A,21A,27B,58B,68C,75C 'control':43B 'cve':13A,16A 'develop':22B 'execut':57B,74C 'file':40B 'let':7A 'librari':32B 'load':28B 'network':9A,61B,78C 'path':6A,37B,64C 'place':49B 'program':30B 'run':11A,46B 'say':52B 'search':5A,36B,63C 'sourc':51B 'studio':2A,20A,26B,67C 'unauthor':54B,71C 'untrust':4A,35B,62C 'visual':1A,19A,25B,66C 'vscode':24B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["studiocode","visualstudiocode"],"ptokens":["code","studio","visual"],"labels":["developers","high","other","vendor","vscode"],"campaign_type":null,"search_a":"'-2026':14A,17A '-70094':15A,18A 'attack':10A 'code':3A,12A,21A 'cve':13A,16A 'let':7A 'network':9A 'path':6A 'run':11A 'search':5A 'studio':2A,20A 'untrust':4A 'visual':1A,19A","search_b":"'attack':42B,55B 'code':27B,58B 'control':43B 'develop':22B 'execut':57B 'file':40B 'librari':32B 'load':28B 'network':61B 'path':37B 'place':49B 'program':30B 'run':46B 'say':52B 'search':36B 'sourc':51B 'studio':26B 'unauthor':54B 'untrust':35B 'visual':25B 'vscode':24B","search_c":"'allow':69C 'attack':72C 'code':68C,75C 'execut':74C 'network':78C 'path':64C 'search':63C 'studio':67C 'unauthor':71C 'untrust':62C 'visual':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70094","severity":null,"published_at":"2026-11-10T19:21:20+00:00","modified_at":"2026-11-10T19:21:20+00:00","first_seen_at":"2026-11-10T19:25:17+00:00","fetched_at":"2026-11-10T19:25:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}