CVE-2026-120779 is a critical (CVSS 9.6) code injection vulnerability in Microsoft Visual Studio Code. An unauthorized attacker can use it to execute code over a network, but the user has to take some action first.
What Is It
The NVD description says the flaw is "improper control of generation of code ('code injection') in Visual Studio Code" and that it "allows an unauthorized attacker to execute code over a network." The weakness is CWE-94 (Improper Control of Generation of Code).
Microsoft ([email protected]) published the CVE on 2026-11-10. NVD lists its status as Awaiting Analysis, so NVD has not added its own scoring or CPE data yet.
Why It Matters
Microsoft scores the flaw 9.6 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H):
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: Required
- Scope: Changed
- Impact: High for confidentiality, integrity and availability
Because the scope is "changed," a successful exploit can reach resources beyond the vulnerable component. That matters on developer workstations, which often hold source code, credentials and access to build systems.
Exploitation status: We did not find this CVE in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of writing. Absence from KEV does not prove that no one is exploiting it. CISA's SSVC assessment (dated 2026-11-10) rates it:
- Exploitation: none
- Automatable: no
- Technical impact: total
CISA's SSVC rating reports no known exploitation as of 2026-11-10. Together with the need for user interaction, that lowers the urgency somewhat. The total technical impact still makes this a priority patch.
What's Vulnerable
According to Microsoft's affected-product data:
- Vendor: Microsoft
- Product: Visual Studio Code
- Affected versions: 1.0.0 up to, but not including, 1.145.3
The NVD record has no CPE entries yet.
Patch Status
Versions before 1.145.3 are listed as affected, which suggests that 1.145.3 and later include the fix. Microsoft's Security Update Guide entry for CVE-2026-120779 is the authoritative source for remediation guidance.
Because the CVE was not in the KEV catalog when this was written, CISA has set no remediation deadline for it. That will change if CISA adds it to KEV.
Recommended actions:
- Check which Visual Studio Code versions run in your environment.
- Update every instance older than 1.145.3.
- Read the MSRC advisory for any further guidance from Microsoft.