Microsoft Visual Studio Code
93 CVEs affecting Microsoft Visual Studio Code. Latest disclosed: 2026-10-13. Critical: 3, High: 72.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-102238 | Critical | 9.6 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a net… |
CVE-2026-81376 | Critical | 9.6 | 2026-09-08 | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-47281 | Critical | 9.6 | 2026-06-09 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70098 | High | 8.8 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-102235 | High | 8.8 | 2026-10-13 | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-69370 | High | 8.8 | 2026-10-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over… |
CVE-2026-78462 | High | 8.8 | 2026-09-08 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-70336 | High | 8.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-59113 | High | 8.8 | 2026-08-11 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-57102 | High | 8.8 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-41613 | High | 8.8 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41109 | High | 8.8 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized a… |
CVE-2026-21518 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
CVE-2025-55319 | High | 8.8 | 2025-09-12 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2024-43488 | High | 8.8 | 2024-10-08 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution th… |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2022-30129 | High | 8.8 | 2022-05-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2020-1416 | High | 8.8 | 2020-07-14 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Stud… |
CVE-2020-1171 | High | 8.8 | 2020-05-21 | A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who… |