Microsoft Visual Studio Code vulnerabilities

CVE-2022-41034 [HIGH] CVE-2022-41034: Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability

CVE-2022-30129 [HIGH] CVE-2022-30129: Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability

CVE-2024-43488 [CRITICAL] CWE-306 CVE-2024-43488: Missing authentication for critical function in Visual Studio Code extension for Arduino allows an u Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

CVE-2025-55319 [CRITICAL] CWE-77 CVE-2025-55319: Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVE-2026-47281 [CRITICAL] CWE-306 CVE-2026-47281: Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges ov Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-21518 [HIGH] CWE-77 CVE-2026-21518: Improper neutralization of special elements used in a command ('command injection') in GitHub Copilo Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2020-1171 [HIGH] CVE-2020-1171: A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads c A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1192.

CVE-2019-0728 [HIGH] CVE-2019-0728: A remote code execution vulnerability exists in Visual Studio Code when it process environment varia A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.

CVE-2026-41109 [HIGH] CWE-74 CVE-2026-41109: Improper neutralization of special elements in output used by a downstream component ('injection') i Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-57102 [HIGH] CWE-200 CVE-2026-57102: Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-41613 [HIGH] CWE-78 CVE-2026-41613: Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-40376 [HIGH] CWE-20 CVE-2026-40376: Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privilege Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

CVE-2020-0604 [HIGH] CVE-2020-0604: A remote code execution vulnerability exists in Visual Studio Code when it process environment varia A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected sy

CVE-2024-26165 [HIGH] CWE-256 CVE-2024-26165: Visual Studio Code Elevation of Privilege Vulnerability Visual Studio Code Elevation of Privilege Vulnerability

CVE-2026-50520 [HIGH] CWE-77 CVE-2026-50520: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

CVE-2026-21523 [HIGH] CWE-367 CVE-2026-21523: Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an auth Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

CVE-2020-1416 [HIGH] CWE-269 CVE-2020-1416: An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they loa An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.

CVE-2025-64660 [HIGH] CWE-284 CVE-2025-64660: Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to ex Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

CVE-2022-21991 [HIGH] CVE-2022-21991: Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability

CVE-2021-43891 [HIGH] CVE-2021-43891: Visual Studio Code Remote Code Execution Vulnerability Visual Studio Code Remote Code Execution Vulnerability