The vulnerability arises from improper encoding or escaping of output in Visual Studio Code. This flaw can allow an unauthorized attacker to inject and execute code through network interactions. The weakness is identified as CWE‑116. Because the output is not correctly sanitized, an attacker could achieve remote code execution, potentially gaining control over the system running the editor.

Microsoft Visual Studio Code is affected. The CPE indicates all variants and versions, as specific version ranges are not enumerated in the CNA data. Any installation of Visual Studio Code that has not received the official update could be vulnerable.

The CVSS score of 8.8 places this issue in the high‑severity category. The EPSS score is not provided, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the vulnerable instance, making the attack vector likely remote. Once exploited, the attacker could execute arbitrary code with the privileges of the VS Code process.