Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
In plain language
Written by AI from the record
CVE-2026-58650 is a local weakness in Visual Studio Code where a malicious person can bypass a security feature by getting you to interact with a specially crafted input; if you use VS Code on a shared or untrusted machine, you should update to the fixed version.
In Visual Studio Code, a user-controlled key value can be manipulated to bypass a security feature, enabling local authorization bypass without any existing credentials; exploitation requires local access to the machine and user interaction.
If you're affected
Bypass code safety protections
Malicious activity on your workstation
Potential data loss or theft
Operational disruption
What is it
Think of VS Code as having a guardrail that helps prevent dangerous actions. This flaw lets someone sneak around that guardrail if they can get on your computer and then trick you into interacting with the right kind of input. That can make it easier for malicious activity to happen from your own workstation.
Who is affected
This matters if you run Visual Studio Code on computers where a malicious person could gain local access (for example, shared machines, kiosks, or systems with multiple users). It does not require you to already be logged in as a particular account for the attacker to start—no existing credentials are required for the bypass. The risk is only present if an attacker can reach the same machine and you are tricked into user interaction.
How urgent is it
This is RED because the weakness is a security-feature bypass and it is tied to local attacker conditions plus user interaction, which is a common path for real-world compromise on shared or untrusted endpoints. Even though there is no dated, clear public exploitation report listed here, the required attack setup still makes it urgent to patch—especially for workstations where someone else may be able to influence what you open or click.
What to do — in detail
Confirm whether you’re exposed
On every affected workstation/server where developers or staff use Visual Studio Code, open VS Code and check the version in Help → About.
Determine whether the installed version is beforeVisual Studio Code 1.132.1.
Remediate (upgrade path)
Upgrade Visual Studio Code to 1.132.1 (or later).
If your environment uses managed deployments (IT-managed updates, endpoint management tools, software repositories), update the deployment package/feed to ensure endpoints receive 1.132.1.
If you can’t upgrade immediately (temporary risk reduction)
Reduce exposure to local, untrusted access: ensure only authorized users can access the workstation.
Limit who can influence what a user opens/clicks (for example, shared accounts, guest sessions, and unmanaged desktop machines increase the chance of the required user interaction being triggered).
Avoid opening files or clicking prompts from unknown sources while the workstation is not yet patched.
What to monitor
After patching, confirm VS Code version Help → About reflects 1.132.1 or later.
Watch for suspicious developer activity patterns on endpoints (unusual downloads, unexpected script execution, or unexpected configuration changes) as part of normal endpoint hygiene.
Timelines
No CISA KEV due date is listed for this issue.
Given the RED verdict and the security-feature bypass nature, prioritize upgrading as soon as possible in your normal patch window.
Technical context
Summary and severity
CVE-2026-58650 is a CWE-639 issue described as a bypass of a security feature in Visual Studio Code. The reported capability is bypassing a restriction by manipulating a user-controlled key value.
Attack mechanism (how it’s triggered)
Local access is required: the attacker must have access to the machine running Visual Studio Code.
No authentication (credentials) are required for the bypass itself.
User interaction is required: the attacker must induce the user to interact with crafted input.
Exploitation status and maturity
This issue is associated with new patch activity, with an actor mentioned in the findings (Lazarus group).
There is no dated KEV listing and no clear dated press exploitation claim provided in the findings.
No public exploit code was reported in the findings.
Patch information
The fix is available in Visual Studio Code 1.132.1 (per MSRC update guide).
EPSS note
EPSS is listed as a prediction (0.5% with flat trend), but this should not be treated as proof of exploitation; this summary sticks to the finding-based facts and the available patch guidance.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
