CVE-2026-58650

Think of VS Code as having a guardrail that helps prevent dangerous actions. This flaw lets someone sneak around that guardrail if they can get on your computer and then trick you into interacting with the right kind of input. That can make it easier for malicious activity to happen from your own workstation.

This matters if you run Visual Studio Code on computers where a malicious person could gain local access (for example, shared machines, kiosks, or systems with multiple users). It does not require you to already be logged in as a particular account for the attacker to start—no existing credentials are required for the bypass. The risk is only present if an attacker can reach the same machine and you are tricked into user interaction.

This is RED because the weakness is a security-feature bypass and it is tied to local attacker conditions plus user interaction, which is a common path for real-world compromise on shared or untrusted endpoints. Even though there is no dated, clear public exploitation report listed here, the required attack setup still makes it urgent to patch—especially for workstations where someone else may be able to influence what you open or click.