Remote Code Execution Vulnerability in webviews
MediumCVE-2026-41611 · Published May 12, 2026
## VS Code - Remote Code Execution Vulnerability A remote code execution vulnerability exists in VS Code 1.119.0 and earlier versions with the internal protocol webviews use to load the VS Code controlled root webview content. This could result in untrusted scripts being run inside the webview ### Patches The fix is available starting with **VS Code 1.119.1**. The fix (https://github.com/microsoft/vscode/commit/1dbe28533fe4204dcd3c3e30a05e22c6ba307145) mitigates this attack by making sure the correctly sized buffer is passed to the webview protocol provider ### Workarounds Do not open webviews that can load untrusted content ### References * The patch for this can be found at https://github.com/microsoft/vscode/commit/1dbe28533fe4204dcd3c3e30a05e22c6ba307145 * MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| vscode Product | < 1.119.1 | 1.119.1 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More Microsoft advisories
All Microsoft| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jun 9 | Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip) | Medium | 1.123.1 |
| Jun 9 | Auto-Approved File Write via Unconfirmed Environment-Variable Path Redirection | Low | 1.123.1 |
| Jun 9 | Unconfirmed Remote Host Connection via Workspace File | High | 1.123.1 |
| May 12 | MCP Deeplink Install Lacked Essential Information | High8.8 | No fix yet |
| May 12 | Apply patch sensitive file workaround | High8.8 | No fix yet |
| May 12 | Remote Code Execution Vulnerability with Jupyter notebook markdown rendering in untrusted workspaces | Medium | 1.119.1 |