CVE-2026-119982

Inline chat could change files beyond the active document

Microsoft · Visual Studio Code inline chat

First documented disclosure · Review checkpoint

Summary

The editor failed to enforce the active-document authorization boundary on edits produced by inline chat. Other workspace files could change without the expected confirmation.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The editor failed to enforce the active-document authorization boundary on edits produced by inline chat.

Conditions required

A user processed untrusted content with inline chat in an affected workspace.

Potential impact

Other workspace files could change without the expected confirmation.

Affected versions and configurations

1.0.0 through versions before 1.145.3, per Microsoft.

Fix and mitigation status

1.145.3.

Practical next steps

Update VS Code and review unexpected workspace edits.

Operating lesson

Track the deployed SDK, extension or managed service when applying Microsoft’s remediation.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources