This vulnerability (CVE-2026-69320) in Microsoft Visual Studio Code involves improper neutralization of special elements used in OS commands, classified as CWE-78 (OS Command Injection). It permits an unauthorized attacker to execute arbitrary code remotely. The vulnerability affects Visual Studio Code version 1.0.0. Microsoft has published an official fix to address this issue, as documented in their security update guide.

Successful exploitation allows an attacker with no privileges and only requiring user interaction to execute arbitrary code remotely, potentially leading to full confidentiality, integrity, and availability compromise of the affected system. The CVSS 3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users should apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69320 to remediate this vulnerability.