Microsoft Visual Studio Code is vulnerable to a relative path traversal flaw that allows an unauthorized attacker to tamper with files over a network. The weakness, identified as CWE-23, permits modification of code or configuration files when a malicious actor can influence request paths. The result is the potential for code injection, alteration of application behavior, or escalation of privileges within the development environment.

The flaw impacts Microsoft Visual Studio Code on all platforms where it is installed. No specific version range is indicated, so any installation of Visual Studio Code may be susceptible until the vendor releases a fixed build.

The CVSS score of 6.5 indicates a medium severity, and although an EPSS score is not available, the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote network connection that an attacker can manipulate, exploiting the relative path traversal to modify files. Given the moderate severity and lack of known exploitation stats, the risk remains significant for any environment that accepts external connections to VS Code or runs untrusted code.