CVE-2026-81380: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81377: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

CVE-2026-78462: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81383: Use of Incorrectly-Resolved Name or Reference

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-88066

Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-70334: Incomplete List of Disallowed Inputs

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

PT-2026-87797

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

KLA91265 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

PT-2026-88065

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-88062

Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81376: Incomplete Comparison with Missing Factors

Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88063

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88064

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclos...

PT-2026-88003

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81379: Not Failing Securely

Not failing securely 'failing open' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81378: Interpretation Conflict

Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

PT-2026-88002

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-81356: Inconsistent Interpretation of HTTP Requests

Inconsistent interpretation of http requests 'http request/response smuggling' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...