CVE-2026-50520 Visual Studio Code Remote Code Execution Vulnerability

...

CVE-2026-50520

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...

CVE-2026-50520

CVE-2026-50520: Visual Studio Code is affected by a command-injection vulnerability due to improper neutralization of special elements in a command, enabling a local attacker to execute code. The CVSS v3.1 base score is 8.4 (HIGH) with LOCAL attack vector, no user interaction required, and high i...

CVE-2026-45496 Visual Studio Code Security Feature Bypass Vulnerability

...

CVE-2026-45496 Visual Studio Code Security Feature Bypass Vulnerability

...

CVE-2026-45496

The CVE-2026-45496 entry describes a path traversal vulnerability in Visual Studio Code where improper limitation of a pathname to a restricted directory allows local attackers to bypass a security feature. Affected component is Visual Studio Code (path handling/file access) with the root cause b...

CVE-2026-47282 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

...

CVE-2026-47282 GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

...

CVE-2026-47282

Summary: CVE-2026-47282 concerns insufficiently protected credentials in GitHub Copilot and Visual Studio Code, leading to potential information disclosure over a network. Impact and scope (as per metrics): CVSS 3.1 base score 6.5 (Medium); attack vector: NETWORK; attack complexity: LOW; privileg...

Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper neutralization of special elements in output used by a downstream component 'injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

Visual Studio Code Security Feature Bypass Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

Visual Studio Code Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Visual Studio Code allows an unauthorized attacker to execute code locally...

CVE-2026-57102: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

KLA91154 Multiple vulnerabilities in Microsoft Visual Studio Code

Multiple vulnerabilities were found in Microsoft Visual Studio Code. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A security feature bypass vulnerability in Visual Studio Code can be...

CVE-2026-57101: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

PT-2026-58130

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-58634

Name of the Vulnerable Software and Affected Versions Visual Studio Code versions prior to 1.128.1 Description The inclusion of functionality from an untrusted control sphere allows an unauthorized attacker to bypass a security feature over a network. Recommendations Update to version 1.128.1...