Microsoft Visual Studio Code VSCode Developer IDE
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Microsoft Visual Studio Code.
Recent Microsoft Visual Studio Code Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2026-41109 | CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | May 12, 2026 |
| CVE-2026-41612 | CVE-2026-41612 Visual Studio Code Information Disclosure Vulnerability | May 12, 2026 |
| CVE-2026-41610 | CVE-2026-41610 Visual Studio Code Security Feature Bypass Vulnerability | May 12, 2026 |
| CVE-2026-41611 | CVE-2026-41611 Visual Studio Code Remote Code Execution Vulnerability | May 12, 2026 |
| CVE-2026-41613 | CVE-2026-41613 Visual Studio Code Elevation of Privilege Vulnerability | May 12, 2026 |
| CVE-2026-23653 | CVE-2026-23653 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability | April 14, 2026 |
| CVE-2026-21523 | CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability | February 10, 2026 |
| CVE-2026-21518 | CVE-2026-21518 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | February 10, 2026 |
| CVE-2025-64660 | CVE-2025-64660 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | November 21, 2025 |
| CVE-2025-62453 | CVE-2025-62453 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | November 11, 2025 |
By the Year
In 2026 there have been 7 vulnerabilities in Microsoft Visual Studio Code with an average score of 7.7 out of ten. Last year, in 2025 Visual Studio Code had 9 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Visual Studio Code in 2026 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.45.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 7 | 7.71 |
| 2025 | 9 | 7.27 |
| 2024 | 5 | 8.46 |
| 2023 | 6 | 7.40 |
| 2022 | 8 | 7.58 |
| 2021 | 19 | 7.52 |
| 2020 | 12 | 7.82 |
| 2019 | 1 | 7.80 |
| 2018 | 1 | 7.80 |
It may take a day or so for new Visual Studio Code vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Visual Studio Code Security Vulnerabilities
May 2026: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2026-41613
8.8 - High
- May 12, 2026
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
Session Fixation
May 2026: Visual Studio Code Information Disclosure Vulnerability
CVE-2026-41612
5.5 - Medium
- May 12, 2026
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
Relative Path Traversal
May 2026: Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-41611
7.8 - High
- May 12, 2026
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
Basic XSS
May 2026: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41610
6.3 - Medium
- May 12, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
XSS
May 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-41109
8.8 - High
- May 12, 2026
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
Injection
Feb 2026: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2026-21523
8 - High
- February 10, 2026
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
TOCTTOU
Feb 2026: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2026-21518
8.8 - High
- February 10, 2026
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Command Injection
Nov 2025: GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-64660
8 - High
- November 20, 2025
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
Authorization
Nov 2025: GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-62453
5 - Medium
- November 11, 2025
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
1426
Sep 2025: Agentic AI and Visual Studio Code Remote Code Execution Vulnerability
CVE-2025-55319
8.8 - High
- September 12, 2025
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
Command Injection
Jul 2025: Visual Studio Code Python Extension Remote Code Execution Vulnerability
CVE-2025-49714
7.8 - High
- July 08, 2025
Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
Trust Boundary Violation
May 2025: Visual Studio Code Security Feature Bypass Vulnerability
CVE-2025-21264
7.1 - High
- May 13, 2025
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Files or Directories Accessible to External Parties
Apr 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-32726
6.8 - Medium
- April 12, 2025
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
Authorization
Mar 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-26631
7.3 - High
- March 11, 2025
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
DLL preloading
Feb 2025: Visual Studio Code Elevation of Privilege Vulnerability
CVE-2025-24039
7.3 - High
- February 11, 2025
Visual Studio Code Elevation of Privilege Vulnerability
DLL preloading
Feb 2025: Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
CVE-2025-24042
7.3 - High
- February 11, 2025
Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
Authorization
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
CVE-2024-49049
7.1 - High
- November 12, 2024
Visual Studio Code Remote Extension Elevation of Privilege Vulnerability
Authorization
VSCode Python Extension Remote Code Execution Vulnerability
CVE-2024-49050
8.8 - High
- November 12, 2024
Visual Studio Code Python Extension Remote Code Execution Vulnerability
Trust Boundary Violation
VS Code Linux RCE Vulnerability
CVE-2024-43601
7.8 - High
- October 08, 2024
Visual Studio Code for Linux Remote Code Execution Vulnerability
Command Injection
Missing Auth in Arduino VS Code Extension Enables RCE
CVE-2024-43488
9.8 - Critical
- October 08, 2024
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.
Missing Authentication for Critical Function
VS Code Privilege Escalation via Unsanitized Input
CVE-2024-26165
8.8 - High
- March 12, 2024
Visual Studio Code Elevation of Privilege Vulnerability
VS Code Python Extension RCE Vulnerability (CVE-2020-17163)
CVE-2020-17163
7.8 - High
- December 29, 2023
Visual Studio Code Python Extension Remote Code Execution Vulnerability
Sep 2023: Visual Studio Code Remote Code Execution Vulnerability
CVE-2023-36742
7.8 - High
- September 12, 2023
Visual Studio Code Remote Code Execution Vulnerability
VS Code Spoofing Vulnerability Enables Data Tampering
CVE-2023-33144
6.6 - Medium
- June 14, 2023
Visual Studio Code Spoofing Vulnerability
VSC Spoofing Vulnerability (CVE-2023-29338)
CVE-2023-29338
6.6 - Medium
- May 09, 2023
Visual Studio Code Spoofing Vulnerability
VS Code RCE via Remote Extension (CVE-2023-24893)
CVE-2023-24893
7.8 - High
- April 11, 2023
Visual Studio Code Remote Code Execution Vulnerability
Microsoft VS Code RCE Vulnerability CVE-2023-21779
CVE-2023-21779
7.8 - High
- January 10, 2023
Visual Studio Code Remote Code Execution Vulnerability
VS Code Elevation of Privilege Vulnerability
CVE-2022-41083
7.8 - High
- October 11, 2022
Visual Studio Code Elevation of Privilege Vulnerability
VS Code RCE Vulnerability via Remote Code Execution
CVE-2022-41034
7.8 - High
- October 11, 2022
Visual Studio Code Remote Code Execution Vulnerability
Microsoft Visual Studio Code Info Disclosure Vulnerability (CVE-2022-41042)
CVE-2022-41042
7.4 - High
- October 11, 2022
Visual Studio Code Information Disclosure Vulnerability
VS Code EOP Vulnerability CVE-2022-38020
CVE-2022-38020
7.3 - High
- September 13, 2022
Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2022-30129
8.8 - High
- May 10, 2022
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-26921
7.3 - High
- April 15, 2022
Visual Studio Code Elevation of Privilege Vulnerability
Mar 2022: Visual Studio Code Spoofing Vulnerability
CVE-2022-24526
6.1 - Medium
- March 09, 2022
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
CVE-2022-21991
8.1 - High
- February 09, 2022
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-43891
7.8 - High
- December 15, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Spoofing Vulnerability
CVE-2021-43908
4.3 - Medium
- December 15, 2021
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
CVE-2021-42322
7.8 - High
- November 10, 2021
Visual Studio Code Elevation of Privilege Vulnerability
Improper Privilege Management
Visual Studio Code Spoofing Vulnerability
CVE-2021-26437
5.5 - Medium
- September 15, 2021
Visual Studio Code Spoofing Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34528
7.8 - High
- July 14, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34529
7.8 - High
- July 14, 2021
Visual Studio Code Remote Code Execution Vulnerability
Microsoft Visual Studio Spoofing Vulnerability
CVE-2021-34479
7.8 - High
- July 14, 2021
Microsoft Visual Studio Spoofing Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-31214
7.8 - High
- May 11, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-31211
7.8 - High
- May 11, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28475
7.8 - High
- April 13, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28473
7.8 - High
- April 13, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28477
7 - High
- April 13, 2021
Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28457
7.8 - High
- April 13, 2021
Visual Studio Code Remote Code Execution Vulnerability
Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28471
7.8 - High
- April 13, 2021
Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-28469
7.8 - High
- April 13, 2021
Visual Studio Code Remote Code Execution Vulnerability
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Microsoft Visual Studio Code or by Microsoft? Click the Watch button to subscribe.
