CVE-2026-69278

Think of Visual Studio Code’s security protections as a locked gate that should stop dangerous actions. This bug is like finding a way to get past the lock—if someone nearby (locally) can get you to click or run something—so the attacker may then gain full control of your computer.

This matters if you use or run Visual Studio Code on a machine where someone else can interact locally (for example, another person with local access) and can get you to take an action in the app. Because the attack requires user interaction, the main risk is being tricked into clicking/approving something while VS Code is running. Reachability in the default configuration is not confirmed here, but the attack requires local access and user interaction.

This is RED because the attacker goal is severe (bypassing security controls to reach full system control) and it only needs local access plus user interaction, which is a common real-world path via social engineering. Microsoft has a specific fix available (1.132.1), so you should treat it as an urgent update for any business machines running Visual Studio Code.