The vulnerability in Visual Studio Code is a session fixation flaw that allows an attacker to take advantage of existing session identifiers and gain elevated privileges without authorization. The flaw falls under CWE‑384, which involves an attacker taking control of a session established for a legitimate user. The possible exploitation could result in the attacker running code or accessing data with higher privileges than intended for the user, potentially leading to unauthorized access or control over the affected system.

Microsoft Visual Studio Code is impacted. Specific affected versions are not disclosed; users should verify whether their installed edition remains vulnerable and apply updates as soon as available.

The CVSS score of 8.8 denotes a high severity level. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The description indicates that the attack requires network access to an instance of Visual Studio Code. No public exploitation data is provided, so the likelihood of active exploitation remains unclear.