CVE-2022-30129

CVE-2022-30129 – Visual Studio Code Remote Code Execution is a published vulnerability involving a failure to properly filter externally entered data during code construction, enabling a remote attacker to execute arbitrary code on the affected Visual Studio Code instance. The issue is described ...

CVE-2025-64660

CVE-2025-64660 affects GitHub Copilot and Visual Studio Code with an improper access control flaw that enables an authorized attacker to execute code over a network. The vulnerability is described as a remote code execution issue due to access-control bypass, impacting Visual Studio Code and GitH...

CVE-2022-21991

CVE-2022-21991 is a remote code execution vulnerability in the Visual Studio Code Remote Development Extension. The provided documents confirm an RCE impact (high severity, CVSS v3.1 base 8.1) with network-based access and no user interaction, but do not specify affected product versions or explo...

CVE-2024-26165

CVE-2024-26165 is a Visual Studio Code Elevation of Privilege vulnerability. Connected sources (including the NCSC advisory) report an impact of privilege escalation with a CVSS score around 8.8 and note that updates exist to fix the issue. The NCSC guidance explicitly recommends installing the M...

CVE-2026-21518

CVE-2026-21518 affects GitHub Copilot for Visual Studio Code and VS Code itself. Description: improper neutralization of special elements used in a command (command injection) allows a remote attacker to bypass a security feature over a network. Affected component/input is attacker-controlled net...

CVE-2026-41613

CVE-2026-41613 involves session fixation in Visual Studio Code that allows an unauthorized attacker to elevate privileges over a network. The connected sources corroborate the affected product as Visual Studio Code and describe the impact as privilege elevation via network access. The available d...

CVE-2026-21523

CVE-2026-21523 is a time-of-check time-of-use (TOCTOU) race condition impacting GitHub Copilot and Visual Studio . An authorized attacker could execute code over a network. The issued CVSS 3.1 score is 8.0 (HIGH) with Network attack vector, Low attack complexity, Privileges Required: Low , User I...

CVE-2026-41109

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-40376

CVE-2026-40376 affects Visual Studio Code. The root cause is improper input validation, enabling an unauthorized network-based user to elevate privileges. The CVSS v3.1 base score is 7.5 (HIGH) with NETWORK attack vector, high impact on confidentiality, integrity, and availability; user interacti...

CVE-2026-45482

CVE-2026-45482 affects GitHub Copilot and Visual Studio Code (Copilot Chat extension): improper limitation of a pathname to a restricted directory enables a local attacker to bypass a security feature. Root cause is a path traversal issue in handling file paths. Impact is described as high for co...

CVE-2026-57102

CVE-2026-57102 affects Visual Studio Code. Likely risk: security feature bypass via inclusion of functionality from an untrusted control sphere, exploitable over a network with user interaction required. CVSS v3.1: 8.8 ( HIGH, NETWORK, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H ). Connected sources note...

CVE-2026-50520

CVE-2026-50520: Visual Studio Code is affected by a command-injection vulnerability due to improper neutralization of special elements in a command, enabling a local attacker to execute code. The CVSS v3.1 base score is 8.4 (HIGH) with LOCAL attack vector, no user interaction required, and high i...