Visual Studio Code
by Microsoft
Source repositories
CVEs (85)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-47281 | Cri | 0.62 | 9.6 | 0.01 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2022-41034 | Hig | 0.59 | 7.8 | 0.67 | Oct 11, 2022 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2020-1416 | Hig | 0.58 | 8.8 | 0.06 | Jul 14, 2020 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'. | ||
| CVE-2020-1171 | Hig | 0.58 | 8.8 | 0.05 | May 21, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current… | ||
| CVE-2026-70336 | Hig | 0.57 | 8.8 | 0.01 | Aug 11, 2026 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-69320 | Hig | 0.57 | 8.8 | 0.00 | Aug 11, 2026 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-59113 | Hig | 0.57 | 8.8 | 0.01 | Aug 11, 2026 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2026-41613 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2026 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-41109 | Hig | 0.57 | 8.8 | 0.01 | May 12, 2026 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-21518 | Hig | 0.57 | 8.8 | 0.01 | Feb 10, 2026 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2025-55319 | Hig | 0.57 | 8.8 | 0.01 | Sep 12, 2025 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | ||
| CVE-2024-43488 | Hig | 0.57 | 8.8 | 0.01 | Oct 8, 2024 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector. | ||
| CVE-2024-26165 | Hig | 0.57 | 8.8 | 0.02 | Mar 12, 2024 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2026-45482 | Hig | 0.55 | 8.4 | 0.00 | Jun 9, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2022-30129 | Hig | 0.54 | 8.8 | 0.41 | May 10, 2022 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2026-69306 | Hig | 0.53 | 8.2 | 0.00 | Aug 11, 2026 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2022-21991 | Hig | 0.53 | 8.1 | 0.02 | Feb 9, 2022 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability | ||
| CVE-2019-0728 | Hig | 0.53 | 7.8 | 0.28 | Mar 5, 2019 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'. | ||
| CVE-2026-21523 | Hig | 0.52 | 8.0 | 0.01 | Feb 10, 2026 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. | ||
| CVE-2025-64660 | Hig | 0.52 | 8.0 | 0.01 | Nov 20, 2025 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
- risk 0.62cvss 9.6epss 0.01
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.59cvss 7.8epss 0.67
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.58cvss 8.8epss 0.06
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.
- risk 0.58cvss 8.8epss 0.05
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current…
- risk 0.57cvss 8.8epss 0.01
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.00
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.57cvss 8.8epss 0.01
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
- risk 0.57cvss 8.8epss 0.01
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
- risk 0.57cvss 8.8epss 0.02
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.55cvss 8.4epss 0.00
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.54cvss 8.8epss 0.41
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.53cvss 8.2epss 0.00
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.1epss 0.02
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
- risk 0.53cvss 7.8epss 0.28
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
- risk 0.52cvss 8.0epss 0.01
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
- risk 0.52cvss 8.0epss 0.01
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
Page 1 of 5