PT-2026-87797

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

CVE-2026-81377: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to perform tampering over a network...

CVE-2026-70334: Incomplete List of Disallowed Inputs

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...

PT-2026-88003

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

KLA91265 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

PT-2026-88065

Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-81380: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

PT-2026-88002

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-78461: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network...

RUSTSEC-2026-0281 `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

`greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

PT-2026-95056

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

PT-2026-95055

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

EUVD-2026-70525

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

CVE-2026-84967 Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

CVE-2026-84967: Improper Neutralization of Special Elements used in an OS Command

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to...

PT-2026-85071

Name of the Vulnerable Software and Affected Versions MongoDB extension for Visual Studio Code affected versions not specified Description A component of the MongoDB extension for Visual Studio Code fails to neutralize special characters within a connection string before incorporating that value...