{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-000041e17747","releaseDate":"2026-10-13T07:00:00-07:00","cveNumber":"CVE-2026-102235","cveTitle":"Visual Studio Code Remote Code Execution Vulnerability","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-13T07:00:00-07:00","description":"<p>Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.</p>\n","cweList":["CWE-116: Improper Encoding or Escaping of Output"],"cweDetailsListForSearch":["cwe: CWE-116: Improper Encoding or Escaping of Output","cweUrl: https://cwe.mitre.org/data/definitions/116.html"],"unformattedDescription":"<p>Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.</p>","mitreText":"CVE-2026-102235","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102235","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Visual Studio Code","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000005,"impact":"Remote Code Execution","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-116: Improper Encoding or Escaping of Output","https://cwe.mitre.org/data/definitions/116.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>An attacker could cause specially crafted content to appear in the Visual Studio Code integrated terminal. If the user clicks the resulting notification link, successful exploitation could allow the attacker to execute commands in the context of the user. Authentication is not required.</p>\n","ordinal":10000},{"title":"Visual Studio Code Remote Code Execution Vulnerability","articleType":"100000000","description":"<p>Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.</p>\n","ordinal":10000},{"title":"Visual Studio Code Remote Code Execution Vulnerability","articleType":"100000000","description":"<p>Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-102235","version":1,"revisionDate":"2026-10-13T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"99a4cbbc-24bc-f111-aaad-000d3a37724b"}]}