Microsoft Visual Studio Code vulnerabilities
67 known vulnerabilities affecting microsoft/visual_studio_code.
Total CVEs
67
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL3HIGH49MEDIUM14LOW1
Vulnerabilities
Page 3 of 4
CVE-2022-26921P3HIGHCVSS 7.8≥ 1.0.0, < 1.66.22022-04-15
CVE-2022-26921 [HIGH] CVE-2022-26921: Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
nvd
CVE-2021-42322P3HIGHCVSS 7.8fixed in 1.16.2≥ 1.0.0, < 1.62.12021-11-10
CVE-2021-42322 [HIGH] CWE-269 CVE-2021-42322: Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
nvd
CVE-2023-24893P3HIGHCVSS 7.8fixed in 1.77.0≥ 1.0.0, < 1.77.02023-04-11
CVE-2023-24893 [HIGH] CWE-20 CVE-2023-24893: Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
nvd
CVE-2019-1414P3HIGHCVSS 7.8fixed in 1.39vunspecified2020-01-24
CVE-2019-1414 [HIGH] CVE-2019-1414: An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listene
An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.
nvd
CVE-2025-24039P3HIGHCVSS 7.3fixed in 1.97.1≥ 1.0.0, < 1.97.12025-02-11
CVE-2025-24039 [HIGH] CWE-427 CVE-2025-24039: Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
nvd
CVE-2025-26631P3HIGHCVSS 7.3fixed in 1.98.0≥ 1.0.0, < 1.98.02025-03-11
CVE-2025-26631 [HIGH] CWE-427 CVE-2025-26631: Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate priv
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-47287P3MEDIUMCVSS 6.5≥ 1.0.0, < 1.123.1≥ 1.0.0, < 1.123.22026-06-09
CVE-2026-47287 [MEDIUM] CWE-23 CVE-2026-47287: Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering o
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
nvd
CVE-2026-47282P3MEDIUMCVSS 6.5fixed in 1.128.1≥ 1.0.0, < 1.128.12026-07-14
CVE-2026-47282 [MEDIUM] CWE-200 CVE-2026-47282: Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-24042P3HIGHCVSS 7.3fixed in 1.97.12025-02-11
CVE-2025-24042 [HIGH] CWE-284 CVE-2025-24042: Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
nvd
CVE-2024-43601P3HIGHCVSS 7.1fixed in 1.94.12024-10-08
CVE-2024-43601 [HIGH] CWE-77 CVE-2024-43601: Visual Studio Code for Linux Remote Code Execution Vulnerability
Visual Studio Code for Linux Remote Code Execution Vulnerability
nvd
CVE-2026-47284P3MEDIUMCVSS 6.5≥ 1.0.0, < 1.123.1≥ 1.0.0, < 1.123.22026-06-09
CVE-2026-47284 [MEDIUM] CWE-200 CVE-2026-47284: Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthori
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2022-41042P3HIGHCVSS 7.4≥ 1.0.0, < 1.72.12022-10-11
CVE-2022-41042 [HIGH] CVE-2022-41042: Visual Studio Code Information Disclosure Vulnerability
Visual Studio Code Information Disclosure Vulnerability
nvd
CVE-2022-38020P3HIGHCVSS 7.3≥ 1.0.0, < 1.71.12022-09-13
CVE-2022-38020 [HIGH] CVE-2022-38020: Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
nvd
CVE-2025-21264P3HIGHCVSS 7.1fixed in 1.100.1≥ 1.0.0, < 1.100.12025-05-13
CVE-2025-21264 [HIGH] CWE-552 CVE-2025-21264: Files or directories accessible to external parties in Visual Studio Code allows an unauthorized att
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
nvd
CVE-2025-32726P4MEDIUMCVSS 6.8fixed in 1.99.1≥ 1.0.0, < 1.99.12025-04-12
CVE-2025-32726 [MEDIUM] CWE-284 CVE-2025-32726: Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges lo
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-45496P4MEDIUMCVSS 5.5fixed in 1.128.1≥ 1.0.0, < 1.128.12026-07-14
CVE-2026-45496 [MEDIUM] CWE-22 CVE-2026-45496: Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
nvd
CVE-2026-48569P4MEDIUMCVSS 5.5≥ 1.0.0, < 1.123.22026-06-09
CVE-2026-48569 [MEDIUM] CWE-20 CVE-2026-48569: Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
nvd
CVE-2026-57101P4MEDIUMCVSS 6.1≥ 1.0.0, < 1.128.12026-07-14
CVE-2026-57101 [MEDIUM] CWE-79 CVE-2026-57101: Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
nvd
CVE-2025-62453P4MEDIUMCVSS 5.0fixed in 1.105.0≥ 1.0.0, < 1.105.02025-11-11
CVE-2025-62453 [MEDIUM] CWE-693 CVE-2025-62453: Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an autho
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2026-41610P4MEDIUMCVSS 5.0fixed in 1.119.1≥ 1.0.0, < 1.119.12026-05-12
CVE-2026-41610 [MEDIUM] CWE-59 CVE-2026-41610: Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
nvd