CVE-2020-16881

The CVE-2020-16881 entry describes a remote code execution vulnerability in Visual Studio Code triggered when a user opens a malicious package.json. The underlying issue allows code execution in the context of the current user, potentially taking full control if the user has admin rights. Exploit...

CVE-2020-1416

CVE-2020-1416 is the Visual Studio and Visual Studio Code Elevation of Privilege vulnerability. The issue arises when these products load software dependencies, allowing a local attacker who can plant malicious content to execute arbitrary code with the user’s privileges. Microsoft’s advisory sta...

CVE-2020-16977

CVE-2020-16977 describes a remote code execution vulnerability in Visual Studio Code arising when the Python extension loads a Jupyter notebook file. An attacker who can entice a user to open a specially crafted notebook could run arbitrary code in the user’s context, potentially gaining full sys...

CVE-2026-47281

CVE-2026-47281 affects Visual Studio Code and is due to improper input validation in the application. The vulnerability allegedly allows an unauthenticated attacker to elevate privileges over a network, with the impact described as high confidentiality, integrity, and availability. The CVSS 3.1 v...

CVE-2021-31214

CVE-2021-31214 is a Visual Studio Code remote code-execution issue arising from the Grunt, Gulp and Jake task auto-detection. Connected advisories indicate this affects Visual Studio Code prior to the upstream patch and that fixes were released upstream in version 1.58.0-1, with Arch Linux noting...

CVE-2020-0604

CVE-2020-0604 is a Visual Studio Code remote code execution vulnerability. According to provided documents, it occurs when VS Code processes environment variables after opening a project, allowing attacker-supplied code to run in the targeted user’s context if they clone a repository and open it ...

CVE-2020-17023

CVE-2020-17023 — Visual Studio Code remote code execution Affected product: Visual Studio Code. Vulnerability: A remote code execution flaw occurs when a user is tricked into opening a malicious package.json; attacker-supplied code runs in the context of the current user. Exploitation requires co...

CVE-2024-43488

CVE-2024-43488 affects the Visual Studio Code extension for Arduino. The vulnerability is a missing authentication in a critical function, enabling remote code execution over a network attack vector. Impact per sources is arbitrary code execution with high/critical severity. Affected component is...

CVE-2025-55319

CVE-2025-55319 corresponds to a remote code execution issue involving Agentic AI in Microsoft Visual Studio Code. The vulnerability allows an unauthenticated, network-based attacker to execute arbitrary code on the affected host via the Agentic AI functionality integrated with VS Code. The CVE is...

CVE-2020-17104

CVE-2020-17104 concerns Visual Studio Code JSHint Extension. Root cause per PT-2020-4828: insufficient input validation in the Visual Studio Code editor, enabling a remote attacker to execute arbitrary code via a specially crafted file. The connected document does not specify affected versions or...

CVE-2019-0728

CVE-2019-0728 describes a remote code execution vulnerability in Visual Studio Code: if the editor processes environment variables when a project is opened, an attacker could run arbitrary code in the current user context. Exploitation requires user action to clone a repository and open it in VS ...