What is CVE-2026-70335?

CVE-2026-70335 is a high-severity vulnerability in Microsoft Visual Studio Code, classified under OS Command Injection. CVSS score: 7.8/10. Published 2026-08-11.

How severe is CVE-2026-70335?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Microsoft Visual Studio Code

CVE-2026-70335

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Microsoft Visual Studio Code — versions 1.0.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability (vendor-advisory, patch)

Frequently asked questions

What is CVE-2026-70335?: CVE-2026-70335 is a high-severity vulnerability in Microsoft Visual Studio Code, classified under OS Command Injection. CVSS score: 7.8/10. Published 2026-08-11.
How severe is CVE-2026-70335?: High severity. CVSS v3 base score is 7.8 out of 10.