Technical impact
The vulnerability is a path traversal flaw that allows an attacker to bypass a security feature within Visual Studio Code. By crafting a specially designed file path, an unauthorized local user could potentially access or manipulate files outside the intended restricted directory, undermining the integrity and confidentiality of the local development environment. The weakness is classified as CWE‑22, which indicates improper handling of file path resolution. The immediate impact is a local security flaw that could facilitate further exploitation if the attacker has sufficient local privileges or can trick a trusted process into using a malicious path.
Affected Systems
Microsoft Visual Studio Code is the affected product. No specific versions are listed, so all currently installed instances may be vulnerable until the issue is patched.
Risk and Exploitability
The CVSS score is 5.5, which places the vulnerability in the medium severity range. The EPSS score is reported as less than 1%, suggesting a very low probability of widespread exploitation at this time. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local: the attacker must have some local presence or be able to supply a crafted path to the Visual Studio Code process. Once the path traversal succeeds, the attacker can manipulate file system paths in ways that bypass local security controls.
