Product:
Visual Studio Code
Summary
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. This vulnerability can lead to significant confidentiality issues as sensitive information may be exposed. Attackers can exploit this flaw without needing elevated privileges, making it a medium severity risk.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-41612 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system running Visual Studio Code. By manipulating file paths, the attacker can access files outside of the intended directory, potentially disclosing sensitive information. User interaction is required, as the attacker must trick the user into opening a malicious file or executing a specific command.
Affected Products
- Visual Studio Code: A code editor that may allow unauthorized access to local files due to path traversal issues.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Visual Studio Code and apply any available security updates. Additionally, users should be cautious about opening files from untrusted sources and review their file access permissions to limit exposure.