This vulnerability is a classic path traversal flaw in Visual Studio Code that allows an attacker with network access to navigate outside the intended directory boundary and access or modify files that should be protected. The flaw could enable reading sensitive configuration files or code, potentially leading to privilege escalation within the local environment if additional conditions are met. The impact is limited to unauthorized file access rather than direct code execution, but the ability to read or write strategic files can weaken overall system integrity. The description does not indicate the ability to execute arbitrary code, but it does provide a vector for confidential information leakage or modifications that could be detrimental to users.

Microsoft Visual Studio Code is affected; no explicit version range is provided in the CNA data, so all installations of VS Code should be evaluated for the presence of the fix. The vulnerability exists regardless of the specific patch level until the update that addresses it is applied.

The CVSS score of 7.4 indicates a high severity with considerable impact on confidentiality and integrity, while the EPSS score is 1% and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be over a network, as the flaw is described as a network‑based security feature bypass. Attackers would need to send crafted requests or trigger the vulnerable path resolve process; no local privilege escalation or authentication conditions are mentioned, so the feature appears exploitable by remote hosts that can communicate with the affected VS Code instance.