Key points
- Microsoft Visual Studio Code versions prior to 1.141.1 are affected by CVE-2026-102238.
- The flaw allows unauthorized attackers to execute code remotely via path traversal.
- The National Vulnerability Database rates the severity as critical with a CVSS score of 9.6.
Microsoft released a security update for Visual Studio Code to address a critical remote code execution vulnerability. The issue, tracked as CVE-2026-102238, affects all versions of the code editor before 1.141.1. Users running older builds must upgrade to the latest version to protect their systems from unauthorized network-based attacks.
In plain English
This flaw involves path traversal, which occurs when software fails to properly restrict file paths. An attacker can manipulate these paths to access restricted directories on a victim’s machine. In this specific case, the improper limitation allows an unauthorized user to run arbitrary code on the system. This means the attacker can execute code over a network without proper authorization.
The background
The Microsoft Security Update Guide describes the vulnerability as an improper limitation of a pathname to a restricted directory. This weakness aligns with CWE-22, a common standard for path traversal errors. The National Vulnerability Database assigns a CVSS score of 9.6, categorizing the risk as critical. This high score reflects the ease with which an attacker can exploit the flaw over a network to execute code.
What changes now
Users must install Visual Studio Code version 1.141.1 or any subsequent release to resolve the issue. This update addresses the path traversal vulnerability that previously allowed unauthorized code execution. Organizations should verify their current installations and apply the update immediately. Delaying the patch leaves systems exposed to remote attacks by unauthorized attackers.
Who needs to act first
Teams should prioritize updating systems that are directly accessible from the internet or external networks. Check whether development machines or build servers run vulnerable versions of the editor. Roll out the update to these high-exposure systems first to reduce the attack surface. Test the new version in a non-production environment to ensure compatibility with existing extensions and workflows. Back up critical project files before applying changes to prevent data loss during the update process.
Background: Path traversal vulnerabilities
Prevent path traversal by enforcing strict allowlists for permitted file names, using chroots to isolate processes, and canonicalizing paths to resolve symbolic links. Avoid relying solely on input filtering, as attackers can encode slashes or use null bytes to bypass basic checks.
Read the full guide: Stop Path Traversal Attacks: Defense Strategies That Actually Work
What to do and how to stay safe: Visual Studio Code
- Check your current Visual Studio Code version against the affected list and update if it is older than 1.141.1.
- Monitor network logs for unusual outbound connections that might indicate remote code execution attempts.
- Restrict network access to development machines where possible to limit exposure to untrusted sources.
- Enable automatic updates for the code editor to ensure future security patches are applied promptly.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Visual Studio Code are vulnerable?
All versions of Microsoft Visual Studio Code before 1.141.1 are affected by this path traversal vulnerability.
Is there a fix available for CVE-2026-102238?
Yes, Microsoft has released version 1.141.1 which patches the critical remote code execution flaw.
How severe is this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.6.
