The vulnerability is a missing authorization check in Visual Studio Code that permits an unauthenticated attacker to execute arbitrary code on a target system. This flaw, classified as CWE-862, enables full remote code execution without requiring any prior credentials. An attacker could run any code with the privileges of the user running the application, potentially compromising confidentiality, integrity, and availability across the system.

The product affected is Microsoft's Visual Studio Code. Specific product versions are not listed in the advisory, so all installations of this editor remain potentially vulnerable until a patch is applied. Users should assume the vulnerability applies to all versions until confirmed otherwise by Microsoft.

The CVSS score of 8.8 categorizes this as high severity. No EPSS score is available, so the current exploitation probability is unknown. The vulnerability is not in the CISA KEV catalog. The likely attack vector is an unauthenticated network request that reaches the vulnerable code path; an attacker could exploit this by sending a crafted payload to a running instance of the editor. Because no patch has yet been released, the risk remains high until a fix is deployed.