CVE-2026-47292

Think of the MSSQL Extension as a add-on tool inside VS Code. This vulnerability is like letting an untrusted component “plug in” in a way that can run arbitrary commands on your computer. If an attacker can trigger it, they could take control of your workstation and potentially pivot into other systems.

This matters if you use Visual Studio Code and specifically install the “Visual Studio Code - MSSQL Extension” add-on. It’s a local issue without needing authentication, but it requires user interaction, so it depends on an attacker being able to get a user to do something (for example, respond to a prompt or open a crafted item). It’s not yet known from the provided findings whether it’s reachable in the default configuration, so your best indicator is whether the affected extension is installed and what version you’re running.

Verdict: RED. Even though there’s no public exploit code recorded and it’s not on the CISA KEV list, the vulnerability’s design allows arbitrary code execution on a local system without authentication and requires only user interaction—meaning attackers can focus on tricking users. You should update the affected VS Code and extension versions immediately.