Improper input validation in Visual Studio Code can allow an unauthorized local attacker to bypass a security feature, potentially granting access to restricted capabilities or modifying application behavior. This vulnerability maps to CWE-20 and CWE-23, indicating fundamental weaknesses in input handling and path traversal that can be exploited when user input is not properly sanitized.

The affected product is Microsoft Visual Studio Code. Version details are not disclosed in the current advisory, so all released builds may be susceptible until an official patch is issued.

The CVSS score of 7.1 denotes high severity, although the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Based on the description, the likely attack vector is local, requiring the attacker to have user access on the target machine. While remote exploitation is not documented, local privilege escalation or abuse of the bypass could still pose a significant risk to affected users.