Visual Studio Code
by Microsoft
Source repositories
CVEs (85)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-48569 | Hig | 0.46 | 7.1 | 0.00 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2025-21264 | Hig | 0.46 | 7.1 | 0.01 | May 13, 2025 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2021-28477 | Hig | 0.46 | 7.0 | 0.02 | Apr 13, 2021 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2021-1639 | Hig | 0.46 | 7.0 | 0.02 | Feb 25, 2021 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2020-16977 | Hig | 0.46 | 7.0 | 0.03 | Oct 16, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on… | ||
| CVE-2025-32726 | Med | 0.44 | 6.8 | 0.00 | Apr 12, 2025 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. | ||
| CVE-2023-33144 | Med | 0.43 | 6.6 | 0.01 | Jun 14, 2023 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2023-29338 | Med | 0.43 | 6.6 | 0.01 | May 9, 2023 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2026-47285 | Med | 0.42 | 6.5 | 0.01 | Aug 11, 2026 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-50519 | Med | 0.42 | 6.5 | 0.01 | Jun 19, 2026 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-47287 | Med | 0.42 | 6.5 | 0.01 | Jun 9, 2026 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | ||
| CVE-2026-47284 | Med | 0.42 | 6.5 | 0.01 | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-41610 | Med | 0.41 | 6.3 | 0.01 | May 12, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2019-16765 | Hig | 0.41 | 7.4 | 0.05 | Nov 25, 2019 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users… | ||
| CVE-2022-24526 | Med | 0.40 | 6.1 | 0.02 | Mar 9, 2022 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2026-23653 | Med | 0.37 | 5.7 | 0.01 | Apr 14, 2026 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network. | ||
| CVE-2026-41612 | Med | 0.36 | 5.5 | 0.01 | May 12, 2026 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. | ||
| CVE-2021-26437 | Med | 0.36 | 5.5 | 0.02 | Sep 15, 2021 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2025-62453 | Med | 0.33 | 5.0 | 0.00 | Nov 11, 2025 | Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2021-43908 | Med | 0.28 | 4.3 | 0.03 | Dec 15, 2021 | Visual Studio Code Spoofing Vulnerability |
- risk 0.46cvss 7.1epss 0.00
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.46cvss 7.1epss 0.01
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.46cvss 7.0epss 0.02
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.46cvss 7.0epss 0.02
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.46cvss 7.0epss 0.03
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on…
- risk 0.44cvss 6.8epss 0.00
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
- risk 0.43cvss 6.6epss 0.01
Visual Studio Code Spoofing Vulnerability
- risk 0.43cvss 6.6epss 0.01
Visual Studio Code Spoofing Vulnerability
- risk 0.42cvss 6.5epss 0.01
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
- risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.41cvss 6.3epss 0.01
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.41cvss 7.4epss 0.05
If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users…
- risk 0.40cvss 6.1epss 0.02
Visual Studio Code Spoofing Vulnerability
- risk 0.37cvss 5.7epss 0.01
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
- risk 0.36cvss 5.5epss 0.01
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.02
Visual Studio Code Spoofing Vulnerability
- risk 0.33cvss 5.0epss 0.00
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- risk 0.28cvss 4.3epss 0.03
Visual Studio Code Spoofing Vulnerability
Page 4 of 5