Visual Studio Code
by Microsoft
Source repositories
CVEs (107)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-16977 | Hig | 0.46 | 7.0 | 0.03 | Oct 16, 2020 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on… | ||
| CVE-2026-102232 | Hig | 0.45 | 7.0 | 0.00 | Oct 13, 2026 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-102229 | Med | 0.44 | 6.8 | 0.01 | Oct 13, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network. | ||
| CVE-2025-32726 | Med | 0.44 | 6.8 | 0.00 | Apr 12, 2025 | Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally. | ||
| CVE-2023-33144 | Med | 0.43 | 6.6 | 0.01 | Jun 14, 2023 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2023-29338 | Med | 0.43 | 6.6 | 0.01 | May 9, 2023 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2026-81381 | Med | 0.42 | 6.5 | 0.01 | Sep 8, 2026 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-81377 | Med | 0.42 | 6.5 | 0.01 | Sep 8, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | ||
| CVE-2026-47285 | Med | 0.42 | 6.5 | 0.01 | Aug 11, 2026 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-50519 | Med | 0.42 | 6.5 | 0.01 | Jun 19, 2026 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2026-47287 | Med | 0.42 | 6.5 | 0.01 | Jun 9, 2026 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | ||
| CVE-2026-47284 | Med | 0.42 | 6.5 | 0.01 | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||
| CVE-2019-16765 | Hig | 0.42 | 7.4 | 0.05 | Nov 25, 2019 | If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users… | ||
| CVE-2026-41610 | Med | 0.41 | 6.3 | 0.01 | May 12, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||
| CVE-2026-102851 | Med | 0.40 | 6.1 | 0.00 | Oct 13, 2026 | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2022-24526 | Med | 0.40 | 6.1 | 0.02 | Mar 9, 2022 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2026-23653 | Med | 0.37 | 5.7 | 0.01 | Apr 14, 2026 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network. | ||
| CVE-2026-41612 | Med | 0.36 | 5.5 | 0.01 | May 12, 2026 | Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally. | ||
| CVE-2021-26437 | Med | 0.36 | 5.5 | 0.02 | Sep 15, 2021 | Visual Studio Code Spoofing Vulnerability | ||
| CVE-2026-81380 | Med | 0.35 | 5.3 | 0.01 | Sep 8, 2026 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
- risk 0.46cvss 7.0epss 0.03
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on…
- risk 0.45cvss 7.0epss 0.00
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.44cvss 6.8epss 0.01
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
- risk 0.44cvss 6.8epss 0.00
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
- risk 0.43cvss 6.6epss 0.01
Visual Studio Code Spoofing Vulnerability
- risk 0.43cvss 6.6epss 0.01
Visual Studio Code Spoofing Vulnerability
- risk 0.42cvss 6.5epss 0.01
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
- risk 0.42cvss 6.5epss 0.01
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 6.5epss 0.01
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
- risk 0.42cvss 6.5epss 0.01
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
- risk 0.42cvss 7.4epss 0.05
If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users…
- risk 0.41cvss 6.3epss 0.01
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- risk 0.40cvss 6.1epss 0.00
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- risk 0.40cvss 6.1epss 0.02
Visual Studio Code Spoofing Vulnerability
- risk 0.37cvss 5.7epss 0.01
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network.
- risk 0.36cvss 5.5epss 0.01
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.02
Visual Studio Code Spoofing Vulnerability
- risk 0.35cvss 5.3epss 0.01
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Page 5 of 6