Improper neutralization of script‑related HTML tags in a Visual Studio Code web page provides a basic cross‑site scripting vulnerability that lets an attacker execute arbitrary code locally on a machine running VS Code.

Microsoft Visual Studio Code is affected. No specific version range is listed, so any installed instance that has not applied the latest update is potentially vulnerable.

The CVSS score of 7.8 indicates high severity, yet exploitation would likely require an attacker to get the user to open a crafted VS Code web page or exploit a local injection. The EPSS score of 0.0005 (<1%) and the fact that the vulnerability is not in the CISA KEV catalog suggest that the exploit probability in the wild may be lower, but the risk of local code execution remains significant for users who run untrusted content in the editor.