Improper limitation of a pathname to a restricted directory (path traversal) in Visual Studio Code permits an unauthorized attacker to execute code over a network. The flaw falls under the category of path traversal weaknesses (CWE‑22) and can lead to arbitrary code execution, potentially compromising the host system.

Microsoft Visual Studio Code is the vendor and product affected. No specific version data is listed in the entry, so all deployed releases of Visual Studio Code may be vulnerable until a patch is applied.

The CVSS score of 9.6 indicates a critical severity, and although the EPSS score is not provided, the lack of a KEV listing suggests the vulnerability may not yet be actively exploited in the wild, but the high CVSS and network attack possibility still warrant urgent attention. The flaw can be leveraged over a network by a remote attacker to run arbitrary code, making it a high‑risk remote code execution vulnerability.