CVE-2026-81377 is a CWE-22 path traversal vulnerability in Microsoft Visual Studio Code version 1.0.0. It allows an attacker without privileges to perform tampering over a network by exploiting improper pathname restrictions to access or modify files outside intended directories. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and requires user interaction. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability to tamper with files remotely without requiring privileges, potentially modifying files outside the intended directory scope. This could lead to unauthorized changes in the application environment or user data. There is no indication of confidentiality or availability impact. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the vendor-provided patch as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81377 to remediate this vulnerability.