CVE-2026-70335

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Score

CVSS 3.1 7.8 High

Status

Analyzed - secure@microsoft.com

Published

2026-08-11

Last modified

2026-10-28

Weaknesses

CWE-78

Affected products

• Visual Studio Code (Microsoft)

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335