Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
Read the full article at Microsoft Security Response Center →
CVE-2026-102229 Visual Studio Code Information Disclosure Vulnerability
About this summary. This is a short excerpt from the description that Microsoft Security Response Center published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102229
Source attribution: headline and facts are from Microsoft Security Response Center (msrc.microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-70161 .NET Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-96225 .NET Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
Microsoft releases emergency .NET patches for critical Brotli flaw
Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell.
CVE-2026-69926 Desktop Window Manager Elevation of Privilege Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-96234 .NET Information Disclosure Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability
Updated an acknowledgement. This is an informational change only.