Visual Studio Code Improper Input Validation Vulnerability Allowing Privilege Escalation

A vulnerability in Visual Studio Code has been identified, allowing an unauthorized attacker to elevate privileges over a network due to improper input validation. This issue affects Visual Studio Code version 1.119.1.

Impact

Exploitation of this vulnerability could allow an attacker to gain the permissions associated with the MCP Server's managed identity, potentially accessing resources that the identity is authorized to reach. However, this does not extend to broader tenant-level or administrator permissions.

Remediation

Users can download the security update for Visual Studio Code from the Visual Studio Code website. For more information, refer to the release notes.