CVE-2026-102238: Visual Studio Code Path Traversal RCE

CVE-2026-102238 Overview

CVE-2026-102238 is a path traversal vulnerability [CWE-22] in Microsoft Visual Studio Code. The flaw allows an unauthorized attacker to execute code over a network when a user is tricked into interacting with crafted content. The weakness stems from improper limitation of a pathname to a restricted directory, enabling access to files outside the intended workspace scope. Microsoft published the advisory on October 13, 2026.

Critical Impact
Successful exploitation grants remote code execution in the context of the Visual Studio Code process, with scope change affecting resources beyond the vulnerable component.

Affected Products

Microsoft Visual Studio Code
Visual Studio Code extensions and components that resolve attacker-controlled paths
Developer workstations running vulnerable builds across Windows, macOS, and Linux

Discovery Timeline

2026-10-13 - CVE-2026-102238 published to the National Vulnerability Database
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-102238

Vulnerability Analysis

The vulnerability resides in path-handling logic within Visual Studio Code. The affected code fails to normalize or validate pathnames before resolving file operations. An attacker who supplies crafted path segments such as ../ traversal sequences can escape the intended working directory. This allows reading, writing, or executing files outside the restricted scope.

Exploitation requires user interaction, typically opening a malicious workspace, repository, or file. Once triggered, the attacker achieves code execution on the victim's host. The scope change indicator in the CVSS vector reflects impact to resources managed by security authorities beyond Visual Studio Code itself. In practice, this means compromised files, persistence mechanisms, or lateral movement from a developer endpoint into source control, cloud credentials, and signing material stored locally.

Root Cause

The root cause is insufficient canonicalization of user-supplied paths before they reach file system APIs. Visual Studio Code resolves paths from workspace metadata, task definitions, and extension inputs. When traversal sequences are not stripped or rejected, the resolved path points outside the intended directory. The missing boundary check is the classic CWE-22 pattern.

Attack Vector

The attack vector is network-based with low complexity and requires no privileges. A victim must open or interact with attacker-controlled content, such as a repository cloned from an untrusted source, a .vscode configuration folder, or an extension that references malicious paths. On trigger, Visual Studio Code processes the traversal path and executes attacker-chosen code in the user's session. The vulnerability does not require prior authentication to any Microsoft service.

See the Microsoft Security Update Guide for the authoritative technical description.

Detection Methods for CVE-2026-102238

Indicators of Compromise

Visual Studio Code processes spawning shells, scripts, or interpreters with arguments referencing paths outside the opened workspace
Creation or modification of files in sensitive locations such as ~/.ssh/, ~/.aws/, or startup directories by Code.exe or code child processes
Workspace or task configuration files containing traversal sequences like ../../ in program, cwd, or args fields
Outbound network connections initiated by Visual Studio Code or its extension host to unknown infrastructure shortly after opening a repository

Detection Strategies

Hunt for Code.exe, code, or Code Helper processes writing to directories outside the user's workspace root
Alert on Visual Studio Code child processes launching powershell.exe, cmd.exe, bash, sh, or osascript with suspicious arguments
Inspect newly cloned repositories for .vscode/tasks.json and .vscode/launch.json entries containing .. traversal sequences

Monitoring Recommendations

Centralize endpoint process telemetry from developer workstations and correlate Visual Studio Code parent-child relationships
Monitor file integrity on credential stores, SSH keys, and cloud configuration directories on engineering endpoints
Track installation and update events for Visual Studio Code and its extensions to confirm patch coverage across the fleet

How to Mitigate CVE-2026-102238

Immediate Actions Required

Update Visual Studio Code to the fixed version referenced in the Microsoft Security Update Guide
Enable automatic updates for Visual Studio Code across all developer endpoints
Audit installed extensions and remove any that are unmaintained or unused
Instruct developers to avoid opening untrusted repositories outside of isolated or sandboxed environments

Patch Information

Microsoft has issued guidance and a fixed build through its Security Update Guide. Administrators should deploy the patched Visual Studio Code release across managed developer endpoints and verify installed versions through software inventory. Confirm the extension host and Code Helper processes are running the updated binaries after installation.

Workarounds

Open unknown repositories using Visual Studio Code Workspace Trust in restricted mode to disable automatic task execution
Use container-based development environments or remote development hosts to isolate untrusted code from the local file system
Restrict developer accounts from holding long-lived cloud or signing credentials on local disk when possible

bash

# Verify installed Visual Studio Code version on managed endpoints
code --version

# Enforce Workspace Trust restricted mode as the default
# settings.json
# {
#   "security.workspace.trust.enabled": true,
#   "security.workspace.trust.startupPrompt": "always",
#   "security.workspace.trust.untrustedFiles": "prompt"
# }