CVE-2025-58062

LSTM-Kirigaya's openmcp-client is a vscode plugin for mcp developer. Prior to version 0.1.12, when users on a Windows platform connect to an attacker controlled MCP server, attackers could provision a malicious authorization server endpoint to silently achieve an OS command injection attack in th...

Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named...

Safeguarding VS Code against prompt injections

The Copilot Chat extension for VS Code has been evolving rapidly over the past few months, adding a wide range of new features. Its new agent mode lets you use multiple large language models LLMs, built-in tools, and MCP servers to write code, make commit requests, and integrate with external...

Linux Distros Unpatched Vulnerability : CVE-2025-24070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. CVE-2025-24070 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2025-26646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

Linux Distros Unpatched Vulnerability : CVE-2024-43499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - .NET and Visual Studio Denial of Service Vulnerability CVE-2024-43499 Note that Nessus relies on the presence of the package as reported by the vendor...

MAL-2025-38651 Malicious code in vscode-extend (npm)

The package vscode-extend was found to contain malicious code...

MAL-2025-38653 Malicious code in vscode-mssql (npm)

The package vscode-mssql was found to contain malicious code...

MAL-2025-38656 Malicious code in vscode.markdown-it-renderer (npm)

The package vscode.markdown-it-renderer was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 2822922f8dca5f68d170c921999dd1e45b4dd8b470e088d9aadbe5806cc2069b This package installs a dependency hosted on a custom domain...

MAL-2025-15225 Malicious code in aws-core-vscode (npm)

The package aws-core-vscode was found to contain malicious code...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

Security Updates for Microsoft Visual Studio Products (August 2025)

The Microsoft Visual Studio Products are missing a security update. It is, therefore, affected by the following vulnerability: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2025-53773 Note that Nessu...

KLA91073 DoS vulnerability in Microsoft Developer Tools

Denial of service vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to cause denial of service. Original advisories CVE-2025-6965 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-Visual-Studio CVE list...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773

CVE-2025-53773 describes a command-injection-based remote code execution risk in GitHub Copilot and Visual Studio. The root cause is improper neutralization of elements in prompts/config that Copilot can read and act on, potentially allowing an attacker to cause Copilot to modify project configur...

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

KLA86588 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Web Deploy can be exploited remotely to execute arbitrary code. 2...