Microsoft Fixes Visual Studio Code Path Traversal Information Disclosure

Microsoft disclosed and patched CVE-2026-41612, an information disclosure flaw in Visual Studio Code caused by relative path traversal and path traversal issues. The vulnerability is mapped to CWE-23 and CWE-22 and could allow an unauthorized local attacker to disclose file system information, potentially exposing sensitive data on affected systems.

Microsoft assigned the bug a CVSS 3.1 score of 5.5 and said exploitation requires user interaction. The company rated the issue as having high confidentiality impact with no integrity or availability impact, assessed exploitation as less likely, and reported that the flaw was not publicly disclosed and not exploited in the wild at the time of publication. An official security fix is available through Microsoft's update guidance.