CVE-2026-41613

HIGH8.8Published on May 12, 2026

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVSS score8.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-78, CWE-384, CWE-384

Vendorsmicrosoft

Affected products

Vendors	Prodotto	Versioni
microsoft	visual studio code	< 1.119.1

Amazon Kiro: una prompt injection esfiltra dati dal workspace con un solo messaggio

Vulnerabilities

Amazon Kiro: a prompt injection exfiltrates data from the workspace with a single message

Researchers reveal a prompt injection flaw in Amazon Kiro that exfiltrates workspace data via a single message. Affects IDE versions, patched in update.

Aug 28, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Amazon Kiro: a prompt injection exfiltrates data from the workspace with a single message