CVE Feed

    Dashboard / CVE / CVE-2026-119976

    CVE-2026-119976

    External control of file name or path in Visual Studio Code - GitHub Pull Requests and Issues Extension allows an unauthorized attacker to disclose information over a network.

    Published:Nov 10, 2026
    Last Modified:Nov 10, 2026
    EPS:Nov 10, 2026
    EPSS Score:
    CVSS Score:6.5

    Affected Products

    Vendor
    Microsoft
    Product
    Visual Studio Code

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-121664 (CVSS 8.3) — Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code all…
    CVE-2026-121663 (CVSS 8.8) — Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a securit…
    CVE-2026-121662 (CVSS 8.6) — Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allo…
    CVE-2026-121661 (CVSS 7.8) — Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a securit…
    CVE-2026-121660 (CVSS 7.5) — Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a securit…
    CVE-2026-119983 (CVSS 8.8) — Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security …
    CVE-2026-114171 (CVSS 8.8) — User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized att…
    CVE-2026-119982 (CVSS 6.5) — Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature ove…
    CVE-2026-119981 (CVSS 7) — Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate pr…
    CVE-2026-119975 (CVSS 8.8) — Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code all…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119976 — Microsoft (Medium 6.5) | CVE-DB