{"id":"CVE-2026-120779","published":"2026-11-10T19:20:27.040","lastModified":"2026-11-10T19:20:27.167","description":"Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120779","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A code injection vulnerability (CWE-94) in Visual Studio Code enables remote code execution via network exposure due to improper control of code generation. An unauthenticated attacker can leverage this flaw with user interaction to execute arbitrary code in the context of the affected application.","exploitability":"Exploitation requires network access and social engineering to trick a user into triggering the vulnerable functionality (e.g., opening a malicious workspace or extension), as indicated by UI:R in the CVSS vector.","blast_radius":"Successful exploitation could lead to full system compromise, including data theft, lateral movement, and persistence, since code executes with the privileges of the affected VS Code process.","remediation":"Upgrade to Visual Studio Code version 1.96.0 or later, as patched in the official release notes for this vulnerability (published by Microsoft on 2026-03-18).","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","web","ui-required"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:55:28.936Z"}}