Visual Studio Code
by Microsoft
Source repositories
CVEs (107)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-102238 | Cri | 0.62 | 9.6 | 0.01 | Oct 13, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-81376 | Cri | 0.62 | 9.6 | 0.01 | Sep 8, 2026 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-47281 | Cri | 0.62 | 9.6 | 0.01 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2022-41034 | Hig | 0.59 | 7.8 | 0.67 | Oct 11, 2022 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2020-1416 | Hig | 0.58 | 8.8 | 0.06 | Jul 14, 2020 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'. | ||
| CVE-2020-1171 | Hig | 0.58 | 8.8 | 0.05 | May 21, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current… | ||
| CVE-2026-70098 | Hig | 0.57 | 8.8 | 0.00 | Oct 13, 2026 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-102235 | Hig | 0.57 | 8.8 | 0.01 | Oct 13, 2026 | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-69370 | Hig | 0.57 | 8.8 | 0.01 | Oct 13, 2026 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-78462 | Hig | 0.57 | 8.8 | 0.01 | Sep 8, 2026 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-70336 | Hig | 0.57 | 8.8 | 0.01 | Aug 11, 2026 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-69320 | Hig | 0.57 | 8.8 | 0.01 | Aug 11, 2026 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-59113 | Hig | 0.57 | 8.8 | 0.01 | Aug 11, 2026 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-41613 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2026 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-41109 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2026 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-21518 | Hig | 0.57 | 8.8 | 0.01 | Feb 10, 2026 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2025-55319 | Hig | 0.57 | 8.8 | 0.01 | Sep 12, 2025 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2024-43488 | Hig | 0.57 | 8.8 | 0.01 | Oct 8, 2024 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector. | ||
| CVE-2024-26165 | Hig | 0.57 | 8.8 | 0.02 | Mar 12, 2024 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2026-45482 | Hig | 0.55 | 8.4 | 0.00 | Jun 9, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
- risk 0.62cvss 9.6epss 0.01
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.62cvss 9.6epss 0.01
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.62cvss 9.6epss 0.01
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.59cvss 7.8epss 0.67
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.58cvss 8.8epss 0.06
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.
- risk 0.58cvss 8.8epss 0.05
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current…
- risk 0.57cvss 8.8epss 0.00
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
- risk 0.57cvss 8.8epss 0.02
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.55cvss 8.4epss 0.00
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Page 1 of 6