CVE-2026-41612 Overview
CVE-2026-41612 is a relative path traversal vulnerability [CWE-22] in the Microsoft Live Preview extension for Visual Studio Code. The flaw allows an unauthorized attacker to disclose information locally by crafting input that escapes the intended directory scope. Exploitation requires local access and user interaction, which limits scale but not impact on developer workstations that frequently open untrusted projects.
Microsoft assigned this issue a CVSS 3.1 base score of 5.5 and published advisory details through the Microsoft Security Response Center. The vulnerability affects confidentiality only, with no direct impact on integrity or availability of the host system.
Critical Impact
An attacker can read arbitrary files accessible to the Visual Studio Code process by tricking a user into previewing a malicious workspace, exposing source code, credentials, or configuration data.
Affected Products
- Microsoft Live Preview extension for Visual Studio Code
- Visual Studio Code installations using vulnerable Live Preview versions
- Developer workstations on Windows, macOS, and Linux running the affected extension
Discovery Timeline
- 2026-05-12 - CVE-2026-41612 published to NVD
- 2026-05-15 - Last updated in NVD database
Technical Details for CVE-2026-41612
Vulnerability Analysis
The Live Preview extension serves local workspace files through an embedded HTTP server so developers can render HTML, CSS, and JavaScript in real time. The vulnerability stems from improper validation of relative path segments in requests handled by this server. An attacker who controls workspace content can craft references using ../ sequences that resolve outside the intended preview root.
When Visual Studio Code processes the malicious request, the extension reads the targeted file and returns its contents in the preview response. This grants read access to any file the editor process can open. On developer machines this commonly includes SSH keys, cloud provider credentials, source code from other projects, and environment files with API tokens.
The issue is categorized as an information disclosure flaw rather than code execution. It does not modify files or grant persistent access, but harvested secrets often enable follow-on attacks against cloud, source control, and identity systems.
Root Cause
The extension fails to canonicalize requested paths before joining them with the workspace base directory. Without normalization that rejects parent directory references, relative traversal sequences pass through to the underlying file read operation and resolve against the filesystem root.
Attack Vector
Exploitation requires the victim to open a malicious workspace and activate Live Preview on an attacker-supplied file. The attacker then triggers requests, typically through embedded HTML or fetch calls, that include traversal sequences pointing at sensitive paths. The response delivers the file contents back to the attacker-controlled page.
The vulnerability manifests in the static file handler of the Live Preview server. Refer to the Microsoft Security Update CVE-2026-41612 advisory for vendor-provided technical specifics.
Detection Methods for CVE-2026-41612
Indicators of Compromise
- HTTP requests to the local Live Preview server containing ../ or URL-encoded %2e%2e%2f sequences in the path
- Unexpected reads of sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env by the Visual Studio Code process
- Live Preview sessions initiated against workspaces cloned from untrusted sources
Detection Strategies
- Inspect process telemetry for Code.exe or code reading files outside active workspace directories
- Monitor loopback network activity on Live Preview ports for requests containing traversal patterns
- Review extension host logs for file read operations originating from preview request handlers
Monitoring Recommendations
- Alert on Visual Studio Code processes accessing credential stores, private keys, or files in user home subdirectories not part of the open workspace
- Track installation and version inventory of the Live Preview extension across developer fleets
- Correlate workspace open events with subsequent outbound network requests to non-corporate destinations
How to Mitigate CVE-2026-41612
Immediate Actions Required
- Update the Microsoft Live Preview extension to the latest patched version through the Visual Studio Code Marketplace
- Disable or uninstall Live Preview on workstations that cannot be updated promptly
- Avoid opening untrusted workspaces with Live Preview active and rely on Workspace Trust prompts before enabling extensions
Patch Information
Microsoft has published patch guidance in the Microsoft Security Update CVE-2026-41612 advisory. Apply the fixed extension version through the standard Visual Studio Code extension update channel and verify the installed version matches the vendor-listed fixed release.
Workarounds
- Uninstall the Live Preview extension until patched versions are deployed across the environment
- Enable Visual Studio Code Workspace Trust and restrict extension execution in untrusted folders
- Run Visual Studio Code under a least-privilege user account that cannot read sensitive credential files
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
