Microsoft Visual Studio Code VSCode Developer IDE
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft Visual Studio Code.
Recent Microsoft Visual Studio Code Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2026-81377 | CVE-2026-81377 Visual Studio Code Tampering Vulnerability | September 8, 2026 |
| CVE-2026-81380 | CVE-2026-81380 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability | September 8, 2026 |
| CVE-2026-81381 | CVE-2026-81381 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability | September 8, 2026 |
| CVE-2026-81383 | CVE-2026-81383 Visual Studio Code Information Disclosure Vulnerability | September 8, 2026 |
| CVE-2026-81357 | CVE-2026-81357 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
| CVE-2026-78461 | CVE-2026-78461 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
| CVE-2026-81356 | CVE-2026-81356 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
| CVE-2026-81378 | CVE-2026-81378 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
| CVE-2026-70334 | CVE-2026-70334 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
| CVE-2026-81376 | CVE-2026-81376 Visual Studio Code Security Feature Bypass Vulnerability | September 8, 2026 |
By the Year
In 2026 there have been 38 vulnerabilities in Microsoft Visual Studio Code with an average score of 7.7 out of ten. Last year, in 2025 Visual Studio Code had 9 security vulnerabilities published. That is, 29 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.41.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 38 | 7.68 |
| 2025 | 9 | 7.27 |
| 2024 | 5 | 8.26 |
| 2023 | 6 | 7.40 |
| 2022 | 8 | 7.58 |
| 2021 | 19 | 7.52 |
| 2020 | 12 | 7.82 |
| 2019 | 1 | 7.80 |
| 2018 | 1 | 7.80 |
It may take a day or so for new Visual Studio Code vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Visual Studio Code Security Vulnerabilities
Sep 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-81383
7.4 - High
- September 08, 2026
Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Use of Incorrectly-Resolved Name or Reference
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-78462
8.8 - High
- September 08, 2026
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Insecure Direct Object Reference / IDOR
Sep 2026: GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
CVE-2026-81381
6.5 - Medium
- September 08, 2026
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Insufficiently Protected Credentials
Sep 2026: GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
CVE-2026-81380
5.3 - Medium
- September 08, 2026
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Command Injection
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81379
8.2 - High
- September 08, 2026
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Failing Open
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81378
8.2 - High
- September 08, 2026
Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Interpretation Conflict
Sep 2026: Visual Studio Code Tampering Vulnerability
CVE-2026-81377
6.5 - Medium
- September 08, 2026
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
Directory traversal
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81376
9.6 - Critical
- September 08, 2026
Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Incomplete Comparison with Missing Factors
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81357
8.2 - High
- September 08, 2026
Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
SSRF
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-81356
8.2 - High
- September 08, 2026
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
HTTP Request Smuggling
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-78461
7.4 - High
- September 08, 2026
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Directory traversal
Sep 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-70334
7.8 - High
- September 08, 2026
Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Denylist / Deny List
Aug 2026: Visual Studio Code Python Extension Security Feature Bypass Vulnerability
CVE-2026-54981
7.8 - High
- August 11, 2026
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.
Inclusion of Functionality from Untrusted Control Sphere
Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-70336
8.8 - High
- August 11, 2026
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Code Injection
Aug 2026: GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-70335
7.8 - High
- August 11, 2026
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
Shell injection
Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-69306
8.2 - High
- August 11, 2026
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Failing Open
Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-69278
7.8 - High
- August 11, 2026
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
AuthZ
Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-69320
8.8 - High
- August 11, 2026
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Shell injection
Aug 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47285
6.5 - Medium
- August 11, 2026
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Command Injection
Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-59113
8.8 - High
- August 11, 2026
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
AuthZ
Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-58650
7.8 - High
- August 11, 2026
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Insecure Direct Object Reference / IDOR
Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-57102
8.8 - High
- July 14, 2026
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Inclusion of Functionality from Untrusted Control Sphere
Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-57101
7.1 - High
- July 14, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
XSS
Jul 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-50520
8.4 - High
- July 14, 2026
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
Command Injection
Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-45496
5.5 - Medium
- July 14, 2026
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Directory traversal
Jul 2026: GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47282
6.5 - Medium
- July 14, 2026
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Insufficiently Protected Credentials
Jun 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-48569
7.1 - High
- June 09, 2026
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper Input Validation
Jun 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47284
6.5 - Medium
- June 09, 2026
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Information Disclosure
Jun 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-47281
9.6 - Critical
- June 09, 2026
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
AuthZ
Jun 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-40376
7.5 - High
- June 09, 2026
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
Improper Input Validation
Jun 2026: Visual Studio Code Tampering Vulnerability
CVE-2026-47287
6.5 - Medium
- June 09, 2026
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
Relative Path Traversal
May 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-41613
8.8 - High
- May 12, 2026
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
Session Fixation
May 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-41612
5.5 - Medium
- May 12, 2026
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
Relative Path Traversal
May 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-41611
7.8 - High
- May 12, 2026
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
Basic XSS
May 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41610
6.3 - Medium
- May 12, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
XSS
May 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41109
8.8 - High
- May 12, 2026
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Injection
Feb 2026: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-21523
8 - High
- February 10, 2026
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
TOCTTOU
Feb 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-21518
8.8 - High
- February 10, 2026
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Command Injection
Nov 2025: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-64660
8 - High
- November 20, 2025
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
Authorization
Nov 2025: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-62453
5 - Medium
- November 11, 2025
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
1426
Sep 2025: Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-55319
8.8 - High
- September 12, 2025
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
Command Injection
Jul 2025: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2025-49714
7.8 - High
- July 08, 2025
Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
Trust Boundary Violation
May 2025: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-21264
7.1 - High
- May 13, 2025
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Files or Directories Accessible to External Parties
Apr 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-32726
6.8 - Medium
- April 12, 2025
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
Authorization
Mar 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-26631
7.3 - High
- March 11, 2025
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
DLL preloading
Feb 2025: Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
CVE-2025-24042
7.3 - High
- February 11, 2025
Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
Authorization
Feb 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-24039
7.3 - High
- February 11, 2025
Visual Studio Code Elevation of Privilege Vulnerability
DLL preloading
VSCode Python Extension Remote Code Execution Vulnerability
CVE-2024-49050
8.8 - High
- November 12, 2024
Visual Studio Code Python Extension Remote Code Execution Vulnerability
Trust Boundary Violation
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-49049
7.1 - High
- November 12, 2024
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
Authorization
Oct 2024: Visual Studio Code extension for Arduino Remote Code Execution Vulnerability
CVE-2024-43488
8.8 - High
- October 08, 2024
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
Missing Authentication for Critical Function
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Visual Studio Code or by Microsoft? Click the Watch button to subscribe.
