Microsoft Visual Studio Code 路径遍历漏洞

Microsoft Visual Studio Code is an open source code editor from Microsoft Corporation USA. A path traversal vulnerability exists in Microsoft Visual Studio Code CoPilot Chat Extension. An attacker exploiting this vulnerability could bypass certain functionality...

PT-2025-46517

Name of the Vulnerable Software and Affected Versions GitHub Copilot and Visual Studio Code affected versions not specified Description A security feature bypass can occur due to improper validation of generative AI output in GitHub Copilot and Visual Studio Code. An authorized attacker can explo...

Vibe-Coded Malicious VS Code Extension Found with Built-In Ransomware Capabilities

Cybersecurity researchers have flagged a malicious Visual Studio Code VS Code extension with basic ransomware capabilities that appears to be created with the help of artificial intelligence – in other words, vibe-coded. Secure Annex researcher John Tuckner, who flagged the extension "susvsex,"...

CVE-2025-62794

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

CVE-2025-62794 GitHub Workflow Updater stored the optional Github token in plaintext

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

GlassWorm Malware Targets Developers Through OpenVSX Marketplace

GlassWorm, a self-propagating malware, infects VS Code extensions through the OpenVSX marketplace, stealing credentials and using blockchain for control...

MAL-2025-48475 Malicious code in @vscode-bicep-ui/components (npm)

The package @vscode-bicep-ui/components was found to contain malicious code...

Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks

New research has uncovered that publishers of over 100 Visual Studio Code VS Code extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk. "A leaked VS Code Marketplace or Open VSX PAT personal access token allow...

EUVD-2021-18126

Malware in sbrugna...

EUVD-2021-15447

Malware in sbrugna...

EUVD-2021-15136

Malware in sbrugna...

EUVD-2021-15149

Malware in sbrugna...

EUVD-2021-13242

Malware in sbrugna...

EUVD-2021-15127

Malware in sbrugna...

EUVD-2019-7295

Malware in sbrugna...

EUVD-2021-16132

Malware in sbrugna...

EUVD-2021-13854

Malware in sbrugna...

EUVD-2021-15604

Malware in sbrugna...

EUVD-2021-15449

Malware in sbrugna...

EUVD-2021-18127

Malware in sbrugna...