CVE Intelligence

Microsoft Visual Studio Code vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Microsoft Visual Studio Code: 54 record(s), with affected versions and fixes.
cpe:2.3:a:microsoft:visual_studio_code

CVE-2026-69306 High · 8.2 CWE-636 Aug 11, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-69278 High · 7.8 CWE-693 Aug 11, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-59113 High · 8.8 CWE-862 Aug 11, 2026
Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-58650 High · 7.8 CWE-639 Aug 11, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47285 Medium · 6.5 CWE-77 Aug 11, 2026
Visual Studio Code Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-57102 High · 8.8 CWE-200 Jul 14, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-57101 Medium · 6.1 CWE-79 Jul 14, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-50520 High · 8.4 CWE-77 Jul 14, 2026
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-47282 Medium · 6.5 CWE-200 Jul 14, 2026
GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45496 Medium · 5.5 CWE-22 Jul 14, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-48569 Medium · 5.5 CWE-20 Jun 9, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47292 High · 7.8 CWE-94 Jun 9, 2026
Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
CVE-2026-47287 Medium · 6.5 CWE-23 Jun 9, 2026
Visual Studio Code Tampering Vulnerability
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-47284 Medium · 6.5 CWE-200 Jun 9, 2026
Visual Studio Code Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-47281 Critical · 9.6 CWE-306 Jun 9, 2026
Visual Studio Code Elevation of Privilege Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-45482 High · 8.4 CWE-22 Jun 9, 2026
Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-40376 High · 8.1 CWE-20 Jun 9, 2026
Visual Studio Code Elevation of Privilege Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41613 High · 8.8 CWE-384 May 12, 2026
Visual Studio Code Elevation of Privilege Vulnerability
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-41611 Low · 3.3 CWE-79 May 12, 2026
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-41610 Medium · 5.0 CWE-79 May 12, 2026
Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-41109 High · 8.8 CWE-74 May 12, 2026
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21523 High · 8.0 CWE-367 Feb 10, 2026
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
CVE-2026-21518 High · 8.8 CWE-77 Feb 10, 2026
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2025-64660 High · 8.0 CWE-284 Nov 20, 2025
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
CVE-2025-62453 Medium · 5.0 CWE-693 Nov 11, 2025
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.