Microsoft Visual Studio Code vulnerabilities

CVE-2022-41034 [HIGH] CVE-2022-41034: Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability

CVE-2022-30129 [HIGH] CVE-2022-30129: Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability

CVE-2024-43488 [CRITICAL] CWE-306 CVE-2024-43488: Missing authentication for critical function in Visual Studio Code extension for Arduino allows an u Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

CVE-2025-55319 [CRITICAL] CWE-77 CVE-2025-55319: Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-69320 [HIGH] CWE-78 CVE-2026-69320: Improper neutralization of special elements used in an os command ('os command injection') in Visual Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-70336 [HIGH] CWE-94 CVE-2026-70336: Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthoriz Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-81376 [CRITICAL] CWE-693 CVE-2026-81376: Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-47281 [CRITICAL] CWE-306 CVE-2026-47281: Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges ov Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-21518 [HIGH] CWE-77 CVE-2026-21518: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilo Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-78462 [HIGH] CWE-639 CVE-2026-78462: Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attack Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-59113 [HIGH] CWE-862 CVE-2026-59113: Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a n Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-41613 [HIGH] CWE-78 CVE-2026-41613: Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2020-0604 [HIGH] CVE-2020-0604: A remote code execution vulnerability exists in Visual Studio Code when it process environment varia A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected sy

CVE-2019-0728 [HIGH] CVE-2019-0728: A remote code execution vulnerability exists in Visual Studio Code when it process environment varia A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.

CVE-2026-41109 [HIGH] CWE-74 CVE-2026-41109: Improper neutralization of special elements in output used by a downstream component ('injection') i Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-40376 [HIGH] CWE-20 CVE-2026-40376: Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privilege Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-57102 [HIGH] CWE-200 CVE-2026-57102: Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2024-26165 [HIGH] CWE-256 CVE-2024-26165: Visual Studio Code Elevation of Privilege Vulnerability Visual Studio Code Elevation of Privilege Vulnerability

CVE-2026-50520 [HIGH] CWE-77 CVE-2026-50520: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

CVE-2026-21523 [HIGH] CWE-367 CVE-2026-21523: Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an auth Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.