Visual Studio Code
by Microsoft
Source repositories
CVEs (107)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-16881 | Hig | 0.51 | 7.8 | 0.05 | Sep 11, 2020 | A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is… | ||
| CVE-2020-0604 | Hig | 0.51 | 7.8 | 0.04 | Aug 17, 2020 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged… | ||
| CVE-2020-1192 | Hig | 0.51 | 7.8 | 0.04 | May 21, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user… | ||
| CVE-2019-1414 | Hig | 0.51 | 7.8 | 0.01 | Jan 24, 2020 | An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'. | ||
| CVE-2018-0597 | Hig | 0.51 | 7.8 | 0.06 | Jun 26, 2018 | Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | ||
| CVE-2026-102231 | Hig | 0.50 | 7.7 | 0.00 | Oct 13, 2026 | Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-40376 | Hig | 0.49 | 7.5 | 0.01 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-102234 | Hig | 0.48 | 7.4 | 0.01 | Oct 13, 2026 | Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2026-81383 | Hig | 0.48 | 7.4 | 0.01 | Sep 8, 2026 | Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-78461 | Hig | 0.48 | 7.4 | 0.01 | Sep 8, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||
| CVE-2025-24042 | Hig | 0.48 | 7.3 | 0.01 | Feb 11, 2025 | Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability | ||
| CVE-2025-24039 | Hig | 0.48 | 7.3 | 0.01 | Feb 11, 2025 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2022-41042 | Hig | 0.48 | 7.4 | 0.02 | Oct 11, 2022 | Visual Studio Code Information Disclosure Vulnerability | ||
| CVE-2022-38020 | Hig | 0.48 | 7.3 | 0.01 | Sep 13, 2022 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2025-26631 | Hig | 0.47 | 7.3 | 0.01 | Mar 11, 2025 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally. | ||
| CVE-2022-26921 | Hig | 0.47 | 7.3 | 0.01 | Apr 15, 2022 | Visual Studio Code Elevation of Privilege Vulnerability | ||
| CVE-2026-48569 | Hig | 0.46 | 7.1 | 0.00 | Jun 9, 2026 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2025-21264 | Hig | 0.46 | 7.1 | 0.01 | May 13, 2025 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2021-28477 | Hig | 0.46 | 7.0 | 0.02 | Apr 13, 2021 | Visual Studio Code Remote Code Execution Vulnerability | ||
| CVE-2021-1639 | Hig | 0.46 | 7.0 | 0.02 | Feb 25, 2021 | Visual Studio Code Remote Code Execution Vulnerability |
- risk 0.51cvss 7.8epss 0.05
A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is…
- risk 0.51cvss 7.8epss 0.04
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged…
- risk 0.51cvss 7.8epss 0.04
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user…
- risk 0.51cvss 7.8epss 0.01
An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.
- risk 0.51cvss 7.8epss 0.06
Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- risk 0.50cvss 7.7epss 0.00
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.49cvss 7.5epss 0.01
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
- risk 0.48cvss 7.4epss 0.01
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.48cvss 7.4epss 0.01
Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.48cvss 7.4epss 0.01
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- risk 0.48cvss 7.3epss 0.01
Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
- risk 0.48cvss 7.3epss 0.01
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.48cvss 7.4epss 0.02
Visual Studio Code Information Disclosure Vulnerability
- risk 0.48cvss 7.3epss 0.01
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.47cvss 7.3epss 0.01
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
- risk 0.47cvss 7.3epss 0.01
Visual Studio Code Elevation of Privilege Vulnerability
- risk 0.46cvss 7.1epss 0.00
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.46cvss 7.1epss 0.01
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.46cvss 7.0epss 0.02
Visual Studio Code Remote Code Execution Vulnerability
- risk 0.46cvss 7.0epss 0.02
Visual Studio Code Remote Code Execution Vulnerability
Page 4 of 6