Microsoft Visual Studio Code
63 CVEs affecting Microsoft Visual Studio Code. Latest disclosed: 2026-07-14. Critical: 1, High: 50.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47281 | Critical | 9.6 | 2026-06-09 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-57102 | High | 8.8 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-41613 | High | 8.8 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41109 | High | 8.8 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized a… |
CVE-2026-21518 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
CVE-2025-55319 | High | 8.8 | 2025-09-12 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2024-43488 | High | 8.8 | 2024-10-08 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution th… |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2022-30129 | High | 8.8 | 2022-05-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2020-1416 | High | 8.8 | 2020-07-14 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Stud… |
CVE-2020-1171 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project, aka 'Visual Stu… |
CVE-2026-50520 | High | 8.4 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code local… |
CVE-2022-21991 | High | 8.1 | 2022-02-09 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability |
CVE-2026-21523 | High | 8.0 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. |
CVE-2025-64660 | High | 8.0 | 2025-11-20 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
CVE-2026-41611 | High | 7.8 | 2026-05-12 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally. |
CVE-2023-36742 | High | 7.8 | 2023-09-12 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-24893 | High | 7.8 | 2023-04-11 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2023-21779 | High | 7.8 | 2023-01-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2022-41034 | High | 7.8 | 2022-10-11 | Visual Studio Code Remote Code Execution Vulnerability |