{"id":"CVE-2026-102235","published":"2026-10-13T20:17:06.607","lastModified":"2026-10-15T20:39:54.150","description":"Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-116"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102235","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Visual Studio Code's improper output encoding allows remote attackers to inject malicious code into rendered content, potentially leading to arbitrary code execution when users view affected content. This vulnerability is particularly dangerous because it can be exploited through network-based interactions without requiring user authentication.","exploitability":"Exploitation requires a remote attacker to deliver specially crafted content that gets rendered by VS Code, with no user interaction needed for the initial delivery but likely requiring user action to view the malicious content.","blast_radius":"The impact could be significant as any user who opens or previews vulnerable content in VS Code could become a victim, potentially affecting developers working with untrusted code repositories or shared development environments.","remediation":"Disable the affected output rendering feature or restrict access to VS Code's network-based content rendering capabilities until a patch is available.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","vscode","output-encoding"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:23:03.117Z"}}