Visual Studio Code (Microsoft) - vulnerabilities (CVEs)

109 CVEs, 10 in the last 30 days, 868 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Visual Studio Code

CVE-2026-102851 - CVSS 6.1 (medium), 2026-10-13: Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
CVE-2026-69370 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over…
CVE-2026-70098 - CVSS 8.8 (high), 2026-10-13: Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102238 - CVSS 9.6 (critical), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a…
CVE-2026-102233 - CVSS 7.8 (high), 2026-10-13: Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-102234 - CVSS 7.4 (high), 2026-10-13: Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-102232 - CVSS 7 (high), 2026-10-13: Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-102231 - CVSS 7.7 (high), 2026-10-13: Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-102235 - CVSS 8.8 (high), 2026-10-13: Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-102229 - CVSS 6.8 (medium), 2026-10-13: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information…
CVE-2026-81383 - CVSS 7.4 (high), 2026-09-08: Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-78462 - CVSS 8.8 (high), 2026-09-08: Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81381 - CVSS 7.5 (high), 2026-09-08: Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-81379 - CVSS 8.2 (high), 2026-09-08: Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81380 - CVSS 5.9 (medium), 2026-09-08: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker…
CVE-2026-81378 - CVSS 8.2 (high), 2026-09-08: Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81377 - CVSS 6.5 (medium), 2026-09-08: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over…
CVE-2026-81376 - CVSS 9.6 (critical), 2026-09-08: Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81357 - CVSS 8.2 (high), 2026-09-08: Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-81356 - CVSS 8.2 (high), 2026-09-08: Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security…
CVE-2026-78461 - CVSS 7.4 (high), 2026-09-08: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security…
CVE-2026-70334 - CVSS 7.8 (high), 2026-09-08: Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-54981 - CVSS 7.8 (high), 2026-08-11: Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature…
CVE-2026-70336 - CVSS 8.8 (high), 2026-08-11: Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-70335 - CVSS 7.8 (high), 2026-08-11: Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized…
CVE-2026-69306 - CVSS 8.2 (high), 2026-08-11: Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 - CVSS 7.8 (high), 2026-08-11: Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-69320 - CVSS 8.8 (high), 2026-08-11: Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute…
CVE-2026-47285 - CVSS 6.5 (medium), 2026-08-11: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose…
CVE-2026-59113 - CVSS 8.8 (high), 2026-08-11: Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 - CVSS 7.8 (high), 2026-08-11: Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-57102 - CVSS 8.8 (high), 2026-07-14: Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57101 - CVSS 7.1 (high), 2026-07-14: Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a…
CVE-2026-50520 - CVSS 8.4 (high), 2026-07-14: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code…
CVE-2026-45496 - CVSS 5.5 (medium), 2026-07-14: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security…
CVE-2026-47282 - CVSS 6.5 (medium), 2026-07-14: Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-48569 - CVSS 7.1 (high), 2026-06-09: Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47287 - CVSS 6.5 (medium), 2026-06-09: Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284 - CVSS 6.5 (medium), 2026-06-09: Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-47292 - CVSS 7.8 (high), 2026-06-09: Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-47281 - CVSS 9.6 (critical), 2026-06-09: Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-45482 - CVSS 8.4 (high), 2026-06-09: Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to…
CVE-2026-40376 - CVSS 8.1 (high), 2026-06-09: Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41613 - CVSS 8.8 (high), 2026-05-12: Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41612 - CVSS 5.5 (medium), 2026-05-12: Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
CVE-2026-41611 - CVSS 7.8 (high), 2026-05-12: Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-41610 - CVSS 6.3 (medium), 2026-05-12: Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a…
CVE-2026-41109 - CVSS 8.8 (high), 2026-05-12: Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized…
CVE-2026-21523 - CVSS 8 (high), 2026-02-10: Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
CVE-2026-21518 - CVSS 8.8 (high), 2026-02-10: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker…
CVE-2025-64660 - CVSS 8 (high), 2025-11-20: Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
CVE-2025-62453 - CVSS 5 (medium), 2025-11-11: Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
CVE-2025-55319 - CVSS 9.8 (critical), 2025-09-12: Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2025-49714 - CVSS 7.8 (high), 2025-07-08: Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
CVE-2025-21264 - CVSS 7.1 (high), 2025-05-13: Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-32726 - CVSS 6.8 (medium), 2025-04-12: Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVE-2025-26631 - CVSS 7.3 (high), 2025-03-11: Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
CVE-2025-24042 - CVSS 7.3 (high), 2025-02-11: Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
CVE-2025-24039 - CVSS 7.3 (high), 2025-02-11: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2024-49050 - CVSS 8.8 (high), 2024-11-12: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2024-49049 - CVSS 7.1 (high), 2024-11-12: Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-43601 - CVSS 7.8 (high), 2024-10-08: Visual Studio Code for Linux Remote Code Execution Vulnerability
CVE-2024-43488 - CVSS 9.8 (critical), 2024-10-08: Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution…
CVE-2024-26165 - CVSS 8.8 (high), 2024-03-12: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2020-17163 - CVSS 7.8 (high), 2023-12-29: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2023-36742 - CVSS 7.8 (high), 2023-09-12: Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-33144 - CVSS 6.6 (medium), 2023-06-14: Visual Studio Code Spoofing Vulnerability
CVE-2023-29338 - CVSS 6.6 (medium), 2023-05-09: Visual Studio Code Spoofing Vulnerability
CVE-2023-24893 - CVSS 7.8 (high), 2023-04-11: Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-21779 - CVSS 7.8 (high), 2023-01-10: Visual Studio Code Remote Code Execution Vulnerability
CVE-2022-41042 - CVSS 7.4 (high), 2022-10-11: Visual Studio Code Information Disclosure Vulnerability
CVE-2022-41034 - CVSS 7.8 (high), 2022-10-11: Visual Studio Code Remote Code Execution Vulnerability
CVE-2022-38020 - CVSS 7.3 (high), 2022-09-13: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-30129 - CVSS 8.8 (high), 2022-05-10: Visual Studio Code Remote Code Execution Vulnerability
CVE-2022-26921 - CVSS 7.8 (high), 2022-04-15: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-24526 - CVSS 6.1 (medium), 2022-03-09: Visual Studio Code Spoofing Vulnerability
CVE-2022-21991 - CVSS 8.1 (high), 2022-02-09: Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
CVE-2021-43908 - CVSS 4.3 (medium), 2021-12-15: Visual Studio Code Spoofing Vulnerability
CVE-2021-43891 - CVSS 7.8 (high), 2021-12-15: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-42322 - CVSS 7.8 (high), 2021-11-10: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2021-26437 - CVSS 5.5 (medium), 2021-09-15: Visual Studio Code Spoofing Vulnerability
CVE-2021-34529 - CVSS 7.8 (high), 2021-07-14: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34528 - CVSS 7.8 (high), 2021-07-14: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34479 - CVSS 7.8 (high), 2021-07-14: Microsoft Visual Studio Spoofing Vulnerability
CVE-2021-31214 - CVSS 7.8 (high), 2021-05-11: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-31211 - CVSS 7.8 (high), 2021-05-11: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28471 - CVSS 7.8 (high), 2021-04-13: Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28477 - CVSS 7.8 (high), 2021-04-13: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28475 - CVSS 7.8 (high), 2021-04-13: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28473 - CVSS 7.8 (high), 2021-04-13: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28469 - CVSS 7.8 (high), 2021-04-13: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28457 - CVSS 7.8 (high), 2021-04-13: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-27084 - CVSS 7.8 (high), 2021-03-11: Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
CVE-2021-27060 - CVSS 7.8 (high), 2021-03-11: Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-1639 - CVSS 7.8 (high), 2021-02-25: Visual Studio Code Remote Code Execution Vulnerability
CVE-2020-17150 - CVSS 7.8 (high), 2020-12-10: Visual Studio Code Remote Code Execution Vulnerability
CVE-2020-17148 - CVSS 7.8 (high), 2020-12-10: Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
CVE-2020-17159 - CVSS 7.8 (high), 2020-12-10: Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability
CVE-2020-17104 - CVSS 7.8 (high), 2020-11-11: Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
CVE-2020-17023 - CVSS 7.8 (high), 2020-10-16: <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who…