Microsoft Visual Studio Code
79 CVEs affecting Microsoft Visual Studio Code. Latest disclosed: 2026-08-11. Critical: 1, High: 64.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47281 | Critical | 9.6 | 2026-06-09 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-70336 | High | 8.8 | 2026-08-11 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-69320 | High | 8.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute cod… |
CVE-2026-59113 | High | 8.8 | 2026-08-11 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-57102 | High | 8.8 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-41613 | High | 8.8 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-41109 | High | 8.8 | 2026-05-12 | Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized a… |
CVE-2026-21518 | High | 8.8 | 2026-02-10 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to… |
CVE-2025-55319 | High | 8.8 | 2025-09-12 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2024-43488 | High | 8.8 | 2024-10-08 | Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution th… |
CVE-2024-26165 | High | 8.8 | 2024-03-12 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2022-30129 | High | 8.8 | 2022-05-10 | Visual Studio Code Remote Code Execution Vulnerability |
CVE-2020-1416 | High | 8.8 | 2020-07-14 | An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Stud… |
CVE-2026-50520 | High | 8.4 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code local… |
CVE-2026-45482 | High | 8.4 | 2026-06-09 | Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypa… |
CVE-2026-69306 | High | 8.2 | 2026-08-11 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2022-21991 | High | 8.1 | 2022-02-09 | Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability |
CVE-2026-21523 | High | 8.0 | 2026-02-10 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network. |
CVE-2025-64660 | High | 8.0 | 2025-11-20 | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. |
CVE-2026-70335 | High | 7.8 | 2026-08-11 | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized atta… |