Visual Studio Code
by Microsoft
Source repositories
CVEs (107)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-30129 | Hig | 0.54 | 8.8 | 0.41 | May 10, 2022 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2026-81379 | Hig | 0.53 | 8.2 | 0.01 | Sep 8, 2026 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-81378 | Hig | 0.53 | 8.2 | 0.01 | Sep 8, 2026 | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-81357 | Hig | 0.53 | 8.2 | 0.01 | Sep 8, 2026 | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-81356 | Hig | 0.53 | 8.2 | 0.01 | Sep 8, 2026 | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-69306 | Hig | 0.53 | 8.2 | 0.01 | Aug 11, 2026 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2022-21991 | Hig | 0.53 | 8.1 | 0.02 | Feb 9, 2022 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability | ||
| CVE-2019-0728 | Hig | 0.53 | 7.8 | 0.28 | Mar 5, 2019 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'. | ||
| CVE-2026-21523 | Hig | 0.52 | 8.0 | 0.01 | Feb 10, 2026 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. | ||
| CVE-2025-64660 | Hig | 0.52 | 8.0 | 0.01 | Nov 20, 2025 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. | ||
| CVE-2021-43891 | Hig | 0.52 | 7.8 | 0.14 | Dec 15, 2021 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2026-102233 | Hig | 0.51 | 7.8 | 0.00 | Oct 13, 2026 | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-70334 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2026 | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-70335 | Hig | 0.51 | 7.8 | 0.00 | Aug 11, 2026 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | ||
| CVE-2026-69278 | Hig | 0.51 | 7.8 | 0.00 | Aug 11, 2026 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-58650 | Hig | 0.51 | 7.8 | 0.00 | Aug 11, 2026 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-44189 | Hig | 0.51 | 7.8 | 0.01 | Jul 22, 2026 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters… | ||
| CVE-2026-47292 | Hig | 0.51 | 7.8 | 0.00 | Jun 9, 2026 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | ||
| CVE-2026-41611 | Hig | 0.51 | 7.8 | 0.01 | May 12, 2026 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. | ||
| CVE-2024-43601 | Hig | 0.51 | 7.8 | 0.01 | Oct 8, 2024 | Visual Studio Code for Linux Remote Code Execution Vulnerability |
- risk 0.54cvss 8.8epss 0.41
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.53cvss 8.2epss 0.01
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.2epss 0.01
Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.2epss 0.01
Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.2epss 0.01
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.2epss 0.01
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.53cvss 8.1epss 0.02
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
- risk 0.53cvss 7.8epss 0.28
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
- risk 0.52cvss 8.0epss 0.01
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
- risk 0.52cvss 8.0epss 0.01
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
- risk 0.52cvss 7.8epss 0.14
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.00
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.51cvss 7.8epss 0.00
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.51cvss 7.8epss 0.00
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.51cvss 7.8epss 0.00
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.51cvss 7.8epss 0.01
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. This command injection vulnerability allows an attacker to craft a malicious playbook filename containing special characters. When a victim runs the playbook, these characters…
- risk 0.51cvss 7.8epss 0.00
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.01
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
- risk 0.51cvss 7.8epss 0.01
Visual Studio Code for Linux Remote Code Execution Vulnerability
Page 2 of 6