Microsoft Visual Studio Code vulnerabilities

CVE-2026-70098 High · 8.8 CWE-862 Oct 13, 2026

Visual Studio Code Remote Code Execution Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-102238 Critical · 9.6 CWE-22 Oct 13, 2026

Visual Studio Code Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-102235 High · 8.8 CWE-116 Oct 13, 2026

Visual Studio Code Remote Code Execution Vulnerability

Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-102234 High · 7.4 CWE-807 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-69370 High · 8.8 CWE-77 Oct 13, 2026

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-102851 Medium · 6.1 CWE-266 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.

CVE-2026-102233 High · 7.8 CWE-862 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-102232 High · 7.0 CWE-863 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-102231 High · 7.7 CWE-41 Oct 13, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-102229 Medium · 6.8 CWE-22 Oct 13, 2026

Visual Studio Code Information Disclosure Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.

CVE-2026-81383 High · 7.4 CWE-706 Sep 8, 2026

Visual Studio Code Information Disclosure Vulnerability

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-81381 High · 7.5 CWE-522 Sep 8, 2026

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-81380 Medium · 5.9 CWE-77 Sep 8, 2026

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

CVE-2026-81379 High · 8.2 CWE-636 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-81378 High · 8.2 CWE-436 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-81377 Medium · 6.5 CWE-22 Sep 8, 2026

Visual Studio Code Tampering Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

CVE-2026-81376 Critical · 9.6 CWE-693 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-81357 High · 8.2 CWE-918 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-81356 High · 8.2 CWE-444 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-78462 High · 8.8 CWE-639 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-78461 High · 7.4 CWE-22 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-70334 High · 7.8 CWE-184 Sep 8, 2026

Visual Studio Code Security Feature Bypass Vulnerability

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-70336 High · 8.8 CWE-94 Aug 11, 2026

Code Injection in Microsoft Visual Studio Code

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-70335 High · 7.8 CWE-78 Aug 11, 2026

OS Command Injection in Microsoft Visual Studio Code

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

CVE-2026-69320 High · 8.8 CWE-78 Aug 11, 2026

OS Command Injection in Microsoft Visual Studio Code

Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.