This vulnerability (CWE-22) in Microsoft Visual Studio Code allows an attacker to perform a path traversal attack by bypassing pathname restrictions, potentially accessing files outside intended directories. The vulnerability is exploitable remotely without privileges and requires user interaction. The CVSS 3.1 base score is 7.4 (high severity), reflecting network attack vector, low attack complexity, no privileges required, but user interaction needed, with high confidentiality impact and no integrity or availability impact. Microsoft has published an official fix for this issue.

An attacker can bypass security features to access restricted files remotely, potentially exposing sensitive information. The confidentiality impact is high, but integrity and availability are not affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the patch provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78461 to remediate this vulnerability.