Microsoft Visual Studio Code VSCode Developer IDE

Aug 2026: Visual Studio Code Python Extension Security Feature Bypass Vulnerability
CVE-2026-54981 7.8 - High - August 11, 2026

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

Inclusion of Functionality from Untrusted Control Sphere

Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-70336 8.8 - High - August 11, 2026

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Code Injection

Aug 2026: GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-70335 7.8 - High - August 11, 2026

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Shell injection

Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-69306 8.2 - High - August 11, 2026

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Failing Open

Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-69278 7.8 - High - August 11, 2026

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

AuthZ

Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-69320 8.8 - High - August 11, 2026

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Shell injection

Aug 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47285 6.5 - Medium - August 11, 2026

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Command Injection

Aug 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-59113 8.8 - High - August 11, 2026

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

AuthZ

Aug 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-58650 7.8 - High - August 11, 2026

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Insecure Direct Object Reference / IDOR

Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-57102 8.8 - High - July 14, 2026

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Inclusion of Functionality from Untrusted Control Sphere

Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-57101 7.1 - High - July 14, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

XSS

Jul 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-50520 8.4 - High - July 14, 2026

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

Command Injection

Jul 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-45496 5.5 - Medium - July 14, 2026

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Directory traversal

Jul 2026: GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47282 6.5 - Medium - July 14, 2026

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Insufficiently Protected Credentials

Jun 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-48569 7.1 - High - June 09, 2026

Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper Input Validation

Jun 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-47284 6.5 - Medium - June 09, 2026

Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

Information Disclosure

Jun 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-47281 9.6 - Critical - June 09, 2026

Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

AuthZ

Jun 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-40376 7.5 - High - June 09, 2026

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Improper Input Validation

Jun 2026: Visual Studio Code Tampering Vulnerability
CVE-2026-47287 6.5 - Medium - June 09, 2026

Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

Relative Path Traversal

May 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-41613 8.8 - High - May 12, 2026

Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Session Fixation

May 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-41612 5.5 - Medium - May 12, 2026

Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.

Relative Path Traversal

May 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-41611 7.8 - High - May 12, 2026

Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

Basic XSS

May 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41610 6.3 - Medium - May 12, 2026

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

XSS

May 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41109 8.8 - High - May 12, 2026

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

Injection

Feb 2026: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-21523 8 - High - February 10, 2026

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

TOCTTOU

Feb 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-21518 8.8 - High - February 10, 2026

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Command Injection

Nov 2025: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-64660 8 - High - November 20, 2025

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Authorization

Nov 2025: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-62453 5 - Medium - November 11, 2025

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

1426

Sep 2025: Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-55319 8.8 - High - September 12, 2025

Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

Command Injection

Jul 2025: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2025-49714 7.8 - High - July 08, 2025

Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.

Trust Boundary Violation

May 2025: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-21264 7.1 - High - May 13, 2025

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Files or Directories Accessible to External Parties

Apr 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-32726 6.8 - Medium - April 12, 2025

Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Authorization

Mar 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-26631 7.3 - High - March 11, 2025

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

DLL preloading

Feb 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-24039 7.3 - High - February 11, 2025

Visual Studio Code Elevation of Privilege Vulnerability

DLL preloading

Feb 2025: Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
CVE-2025-24042 7.3 - High - February 11, 2025

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

Authorization

Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-49049 7.1 - High - November 12, 2024

Visual Studio Code Remote Extension Elevation of Privilege Vulnerability

Authorization

VSCode Python Extension Remote Code Execution Vulnerability
CVE-2024-49050 8.8 - High - November 12, 2024

Visual Studio Code Python Extension Remote Code Execution Vulnerability

Trust Boundary Violation

Oct 2024: Visual Studio Code extension for Arduino Remote Code Execution Vulnerability
CVE-2024-43488 8.8 - High - October 08, 2024

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

Missing Authentication for Critical Function

Oct 2024: Visual Studio Code for Linux Remote Code Execution Vulnerability
CVE-2024-43601 7.8 - High - October 08, 2024

Visual Studio Code for Linux Remote Code Execution Vulnerability

Command Injection

VS Code Privilege Escalation via Unsanitized Input
CVE-2024-26165 8.8 - High - March 12, 2024

Visual Studio Code Elevation of Privilege Vulnerability

VS Code Python Extension RCE Vulnerability (CVE-2020-17163)
CVE-2020-17163 7.8 - High - December 29, 2023

Visual Studio Code Python Extension Remote Code Execution Vulnerability

Sep 2023: Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-36742 7.8 - High - September 12, 2023

Visual Studio Code Remote Code Execution Vulnerability

VS Code Spoofing Vulnerability Enables Data Tampering
CVE-2023-33144 6.6 - Medium - June 14, 2023

Visual Studio Code Spoofing Vulnerability

VSC Spoofing Vulnerability (CVE-2023-29338)
CVE-2023-29338 6.6 - Medium - May 09, 2023

Visual Studio Code Spoofing Vulnerability

VS Code RCE via Remote Extension (CVE-2023-24893)
CVE-2023-24893 7.8 - High - April 11, 2023

Visual Studio Code Remote Code Execution Vulnerability

Microsoft VS Code RCE Vulnerability CVE-2023-21779
CVE-2023-21779 7.8 - High - January 10, 2023

Visual Studio Code Remote Code Execution Vulnerability

VS Code Elevation of Privilege Vulnerability
CVE-2022-41083 7.8 - High - October 11, 2022

Visual Studio Code Elevation of Privilege Vulnerability

VS Code RCE Vulnerability via Remote Code Execution
CVE-2022-41034 7.8 - High - October 11, 2022

Visual Studio Code Remote Code Execution Vulnerability

Microsoft Visual Studio Code Info Disclosure Vulnerability (CVE-2022-41042)
CVE-2022-41042 7.4 - High - October 11, 2022

Visual Studio Code Information Disclosure Vulnerability

VS Code EOP Vulnerability CVE-2022-38020
CVE-2022-38020 7.3 - High - September 13, 2022

Visual Studio Code Elevation of Privilege Vulnerability