CVE-2026-102238

Summary

Visual Studio Code allows attackers to perform path traversal attacks that can lead to arbitrary code execution over the network. This vulnerability occurs when the application improperly limits file pathnames to restricted directories, enabling attackers to access and execute files outside the intended directory structure.

Exploitability

Exploitation is moderately difficult as it requires an attacker to craft a specific malicious request that triggers the path traversal flaw, but once exploited, allows full code execution capabilities.

Blast radius

The impact could be severe across development environments where Visual Studio Code is used for remote collaboration or file sharing, potentially allowing attackers to compromise entire development workspaces and access sensitive source code repositories.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Visual Studio Code version 1.92.0 or later to address this path traversal vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.