CVE-2026-47287 is a relative path traversal vulnerability (CWE-23) in Microsoft Visual Studio Code version 1.0.0. It enables an unauthorized attacker to tamper with resources over a network by exploiting improper handling of relative paths. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction needed. Microsoft has published an official fix for this vulnerability.

The vulnerability allows an attacker to perform tampering actions remotely without requiring privileges, potentially modifying files or resources accessible via relative path traversal. There is no confidentiality or availability impact reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287 to remediate this vulnerability.