High severity7.8NVD Advisory· Published Aug 11, 2026· Updated Sep 2, 2026
CVE-2026-70335
CVE-2026-70335
Description
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Affected products
2cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*range: <1.132.1
- (no CPE)
Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335nvdPatchVendor Advisory
News mentions
3- Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilitiesCisco Talos Intelligence · Aug 11, 2026
- Patch Tuesday - August 2026Rapid7 Blog · Aug 11, 2026
- Microsoft Patch Tuesday Update August 2026 – 394 Vulnerabilities Fixed, Including 3 Zero-DaysCyber Security News · Aug 11, 2026