CVE-2026-41610

MediumCVSS 5.0/10Last modified Oct 26, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-59 CWE-79 CWE-200

Affected software

Vendor	Product	Versions
Microsoft	Visual Studio Code	>= 1.0.0, < 1.119.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41610Vendor Advisory

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-416113.3Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execu CVE-2026-416125.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.CVE-2026-416138.8Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-416146.2Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.CVE-2026-416157.4Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose informatio CVE-2026-41627.1The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plu CVE-2026-41639.8A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.c CVE-2026-416359.8Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the CVE-2026-416367.5Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommen CVE-2026-416373.7In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound CVE-2026-41649.8A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless CVE-2026-416408.8NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.39, th