CVE-2026-120779

Summary

A code injection vulnerability (CWE-94) in Visual Studio Code enables remote code execution via network exposure due to improper control of code generation. An unauthenticated attacker can leverage this flaw with user interaction to execute arbitrary code in the context of the affected application.

Exploitability

Exploitation requires network access and social engineering to trick a user into triggering the vulnerable functionality (e.g., opening a malicious workspace or extension), as indicated by UI:R in the CVSS vector.

Blast radius

Successful exploitation could lead to full system compromise, including data theft, lateral movement, and persistence, since code executes with the privileges of the affected VS Code process.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Visual Studio Code version 1.96.0 or later, as patched in the official release notes for this vulnerability (published by Microsoft on 2026-03-18).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.