Visual Studio Code Security Feature Bypass Vulnerability

Summary

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Products covered

• Visual Studio Code

Remediation

Release Notes

Vendor-listed fixes

• 1.145.3

CVEs in this advisory 1

CVE-2026-121663

Updates

1. Nov 10, 2026 at 8:00 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Nov 10, 2026 at 8:15 PM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.