Vulnerability Overview and Official Advisory Facts
According to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-102229, the official description states:
Microsoft classifies the underlying weakness under CWE-22, which covers improper limitation of a pathname to a restricted directory (commonly known as path traversal). In practical terms, when an application fails to strictly sanitize or confine file path resolution to an intended directory, crafted path sequences can reach parent or sibling folders outside the permitted scope.
The MSRC dossier records the following official advisory facts for CVE-2026-102229:
- Visual Studio Code Information Disclosure Vulnerability: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
- FAQ - Info Disclosure - Local files via SFB: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability by escaping the sandbox, is the ability to read local files.
That sandbox-escape detail is the core operational concern for developers. If an attacker successfully exploits this path traversal flaw to escape the sandbox, the resulting impact is the ability to read local files on the system.
Severity, CVSS Breakdown, and Threat Posture
Microsoft rates CVE-2026-102229 as Important and assigns the full CVSS v3.1 vector string:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Breaking down the metrics in that official vector illustrates how the flaw operates and why the base score reaches 6.8 while the temporal score stands at 5.9:
- Attack Vector (
AV:N): Network-accessible exploitation path. - Attack Complexity (
AC:L): Low complexity once the prerequisites are met. - Privileges Required (
PR:L): Low privileges are required; the attacker must be an authorized attacker. - User Interaction (
UI:R): User interaction is required for exploitation to succeed. - Scope (
S:C): Changed scope, reflecting the official FAQ note that successful exploitation involves escaping the sandbox to read local files. - Confidentiality, Integrity, and Availability (
C:H/I:N/A:N): High impact to confidentiality due to unauthorized reading of local files, with no direct impact to file integrity or system availability. - Temporal Metrics (
E:U/RL:O/RC:C): Unproven exploit maturity (E:U), an official fix is available (RL:O), and report confidence is confirmed (RC:C).
Alongside the numerical scores, Microsoft provides the following status indicators and threat assessment for CVE-2026-102229:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
- Exploitation Assessment: Exploitation Less Likely
Section Summary: While CVE-2026-102229 has not been publicly disclosed or exploited in the wild and is assessed as Exploitation Less Likely, the combination of network reachability, changed security scope via sandbox escape, and high confidentiality impact makes timely patching essential.
Affected Products and Remediation Guidance
Because Customer action required: Yes is set for this advisory, administrators and individual developers using Visual Studio Code must apply the vendor update to close the exposure.
| CVE ID | Affected Product | Severity | CVSS Base / Temporal | CWE | Fixed Build | Official Remediation |
|---|---|---|---|---|---|---|
| CVE-2026-102229 | Visual Studio Code | Important | 6.8 / 5.9 | CWE-22 | 1.141.1 | For Visual Studio Code, update to fixed build 1.141.1 or later. |
Actionable Next Steps for IT and Development Teams
- Verify Installed Builds: Check developer workstations and managed software inventories to identify any Visual Studio Code installations running a build earlier than 1.141.1.
- Apply the Official Fix: Follow Microsoft's exact remediation directive: For Visual Studio Code, update to fixed build 1.141.1 or later.
- Ensure Restart Completion: Confirm that active editor sessions are restarted after the update is staged so the patched 1.141.1 binaries are loaded into memory.
Section Summary: Updating Visual Studio Code to fixed build 1.141.1 or later resolves CVE-2026-102229 and prevents authorized attackers from leveraging CWE-22 path traversal over a network to escape the sandbox and read local files.