Visual Studio Code depends on untrusted input in a security decision process, enabling an attacker to bypass a built‑in security mechanism through the network. This bypass could allow the attacker to perform actions normally restricted by the feature, compromising the confidentiality or integrity of the system.

The vulnerability affects Microsoft Visual Studio Code. No specific version numbers are listed, so all installed instances of Visual Studio Code that have not applied the Microsoft patch are potentially impacted.

The vulnerability scores 7.4 on the CVSS scale, indicating a high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as the description references network‑based input. An adversary would need to supply crafted input to the affected component, and no authentication or privilege escalation is mentioned in the available data.