CVE-2026-58650: Visual Studio Code Auth Bypass Flaw

CVE-2026-58650 Overview

CVE-2026-58650 is an authorization bypass vulnerability in Microsoft Visual Studio Code. The flaw stems from improper validation of a user-controlled key, classified under [CWE-639] Authorization Bypass Through User-Controlled Key. An unauthorized attacker can exploit this weakness locally to bypass a security feature within the editor.

Exploitation requires local access and user interaction. Successful exploitation impacts confidentiality, integrity, and availability. Microsoft published the advisory in the Microsoft Security Update Guide.

Critical Impact
An attacker who convinces a user to perform a specific action can bypass a Visual Studio Code security control, gaining the ability to compromise confidentiality, integrity, and availability on the affected host.

Affected Products

Microsoft Visual Studio Code

Discovery Timeline

2026-08-11 - CVE-2026-58650 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-58650

Vulnerability Analysis

The vulnerability is an authorization bypass caused by reliance on a user-controlled key when enforcing an internal security decision in Visual Studio Code. Because the key can be influenced by the attacker or by a crafted resource loaded into the editor, the authorization check fails to distinguish legitimate operations from unauthorized ones.

Exploitation requires the target user to open or interact with attacker-supplied content, such as a malicious workspace, extension, or project file. Once the security feature is bypassed, the attacker gains access to protected functionality within the local Visual Studio Code process.

The impact spans confidentiality, integrity, and availability because Visual Studio Code executes with the user's privileges and can access source code, credentials stored in editor state, and local files.

Root Cause

The root cause is mapped to [CWE-639]: Authorization Bypass Through User-Controlled Key. The application uses an identifier or reference that the attacker can supply or manipulate, and it does not verify that the requesting user is authorized to act on the resource represented by that key. This design flaw allows attackers to substitute a key that resolves to a privileged or protected resource.

Attack Vector

The attack vector is local and requires user interaction. A typical exploitation chain involves a user opening a crafted workspace, folder, or file in Visual Studio Code. Because no privileges are required to stage the exploit content, an attacker can deliver it through phishing, a shared repository, or a compromised extension package.

No verified proof-of-concept code has been published. Refer to the Microsoft Security Update Guide for vendor-provided technical details.

Detection Methods for CVE-2026-58650

Indicators of Compromise

Unexpected Visual Studio Code child processes spawning shells, script interpreters, or network utilities shortly after opening a workspace.
Modifications to settings.json, tasks.json, or .vscode/ directories from untrusted sources.
Newly installed or auto-updated extensions that were not initiated by the user.

Detection Strategies

Monitor endpoint telemetry for anomalous process trees where Code.exe or code launches unusual child processes.
Track file access patterns targeting credential stores, SSH keys, or cloud configuration files immediately after Visual Studio Code startup.
Compare installed Visual Studio Code versions against the fixed release identified in the Microsoft advisory.

Monitoring Recommendations

Enable command-line auditing on developer workstations to capture Visual Studio Code invocations and their arguments.
Alert on Visual Studio Code opening workspaces from network shares, removable media, or recently downloaded archives.
Log extension installation and update events, and review them for unauthorized additions.

How to Mitigate CVE-2026-58650

Immediate Actions Required

Update Visual Studio Code to the latest release published by Microsoft that addresses CVE-2026-58650.
Restrict opening untrusted workspaces and rely on the Workspace Trust feature to limit code execution from unknown sources.
Audit installed extensions and remove any that are unmaintained or unverified.

Patch Information

Microsoft has released a fixed version of Visual Studio Code. Consult the Microsoft Security Update Guide for the specific build number and download instructions. Deploy the patch across all developer endpoints through managed software distribution.

Workarounds

Enable and enforce Workspace Trust to prevent automatic execution of code in untrusted folders.
Disable automatic extension updates and require review of new extensions before installation.
Run Visual Studio Code under standard user accounts and avoid opening projects received from untrusted parties.

bash

# Verify installed Visual Studio Code version
code --version

# Enforce Workspace Trust via settings.json
# Add the following entries to user settings
# "security.workspace.trust.enabled": true,
# "security.workspace.trust.startupPrompt": "always",
# "security.workspace.trust.untrustedFiles": "prompt"