{"id":"CVE-2026-102238","published":"2026-10-13T20:17:06.727","lastModified":"2026-10-15T20:39:54.150","description":"Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102238","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Visual Studio Code allows attackers to perform path traversal attacks that can lead to arbitrary code execution over the network. This vulnerability occurs when the application improperly limits file pathnames to restricted directories, enabling attackers to access and execute files outside the intended directory structure.","exploitability":"Exploitation is moderately difficult as it requires an attacker to craft a specific malicious request that triggers the path traversal flaw, but once exploited, allows full code execution capabilities.","blast_radius":"The impact could be severe across development environments where Visual Studio Code is used for remote collaboration or file sharing, potentially allowing attackers to compromise entire development workspaces and access sensitive source code repositories.","remediation":"Upgrade to Visual Studio Code version 1.92.0 or later to address this path traversal vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","path-traversal","ide"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:53:45.011Z"}}