Visual Studio Code
by Microsoft
Source repositories
CVEs (58)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-47281 | Cri | 0.62 | 9.6 | 0.01 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2022-41034 | Hig | 0.59 | 7.8 | 0.67 | Oct 11, 2022 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2020-1416 | Hig | 0.58 | 8.8 | 0.06 | Jul 14, 2020 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'. | ||
| CVE-2020-1171 | Hig | 0.58 | 8.8 | 0.14 | May 21, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1192. | ||
| CVE-2026-41109 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2026 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2025-55319 | Hig | 0.57 | 8.8 | 0.01 | Sep 12, 2025 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2024-26165 | Hig | 0.57 | 8.8 | 0.02 | Mar 12, 2024 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2026-45482 | Hig | 0.55 | 8.4 | 0.00 | Jun 9, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2019-0728 | Hig | 0.53 | 7.8 | 0.28 | Mar 5, 2019 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'. | ||
| CVE-2025-64660 | Hig | 0.52 | 8.0 | 0.00 | Nov 20, 2025 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. | ||
| CVE-2021-43891 | Hig | 0.52 | 7.8 | 0.12 | Dec 15, 2021 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2020-1192 | Hig | 0.52 | 7.8 | 0.12 | May 21, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171. | ||
| CVE-2026-47292 | Hig | 0.51 | 7.8 | 0.00 | Jun 9, 2026 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | ||
| CVE-2026-41611 | Hig | 0.51 | 7.8 | 0.00 | May 12, 2026 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. | ||
| CVE-2024-43601 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2024 | Visual Studio Code for Linux Remote Code Execution Vulnerability | ||
| CVE-2023-36742 | Hig | 0.51 | 7.8 | 0.01 | Sep 12, 2023 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2023-24893 | Hig | 0.51 | 7.8 | 0.01 | Apr 11, 2023 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2023-21779 | Hig | 0.51 | 7.8 | 0.02 | Jan 10, 2023 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2022-41083 | Hig | 0.51 | 7.8 | 0.01 | Oct 11, 2022 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2021-42322 | Hig | 0.51 | 7.8 | 0.00 | Nov 10, 2021 | Visual Studio Code Elevation of Privilege Vulnerability |
- risk 0.62cvss 9.6epss 0.01
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.59cvss 7.8epss 0.67
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.58cvss 8.8epss 0.06
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.
- risk 0.58cvss 8.8epss 0.14
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1192.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.02
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.55cvss 8.4epss 0.00
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.53cvss 7.8epss 0.28
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
- risk 0.52cvss 8.0epss 0.00
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
- risk 0.52cvss 7.8epss 0.12
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.52cvss 7.8epss 0.12
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171.
- risk 0.51cvss 7.8epss 0.00
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code for Linux Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.02
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.00
Visual Studio Code Elevation of Privilege Vulnerability
Page 1 of 3