This vulnerability (CVE-2026-47285) in Microsoft Visual Studio Code is classified as CWE-77, indicating improper neutralization of special elements used in a command, commonly known as command injection. The vulnerability allows an attacker without privileges to execute commands that can lead to unauthorized information disclosure over a network. The CVSS 3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. The vulnerability affects Visual Studio Code version 1.0.0. Microsoft has released an official fix for this issue as documented in their security update guide.

An attacker can exploit this vulnerability to disclose sensitive information over a network without requiring privileges, potentially leading to data exposure. There is no impact on integrity or availability. The attack vector is network-based with low attack complexity and no privileges required, but user interaction is needed.

An official fix is available from Microsoft. Users should apply the security update provided by Microsoft for Visual Studio Code version 1.0.0 to remediate this vulnerability. Refer to the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47285 for detailed patch information.