CVE-2026-102229

MediumCVSS 6.8/10Last modified Oct 13, 2026

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 13, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-102236.3A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file tool CVE-2026-1022317.7Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022327.0Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022337.8Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022347.4Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over CVE-2026-1022358.8Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-1022389.6Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to exec CVE-2026-102245.3A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_web CVE-2026-10224010.0A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the CVE-2026-1022412.7A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backu CVE-2026-1022428.6Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 throu CVE-2026-1022437.4A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source