CVE-2019-1414

CVE-2019-1414 affects Visual Studio Code. A local elevation-of-privilege vulnerability arises when VS Code exposes a debug listener/port to the local user, allowing code injection in the user context. Affected versions are generally prior to 1.39.1; remediation is to update VS Code to 1.39.1 or l...

CVE-2020-16881

The CVE-2020-16881 entry describes a remote code execution vulnerability in Visual Studio Code triggered when a user opens a malicious package.json. The underlying issue allows code execution in the context of the current user, potentially taking full control if the user has admin rights. Exploit...

CVE-2020-1416

CVE-2020-1416 is the Visual Studio and Visual Studio Code Elevation of Privilege vulnerability. The issue arises when these products load software dependencies, allowing a local attacker who can plant malicious content to execute arbitrary code with the user’s privileges. Microsoft’s advisory sta...

CVE-2020-16977

CVE-2020-16977 describes a remote code execution vulnerability in Visual Studio Code arising when the Python extension loads a Jupyter notebook file. An attacker who can entice a user to open a specially crafted notebook could run arbitrary code in the user’s context, potentially gaining full sys...

CVE-2020-17148

CVE-2020-17148 affects the Visual Studio Code Remote Development Extension (SSH-based remote access). The root cause is a defect in the SSH editor’s source code handling that enables remote code execution. The vulnerability enables an attacker to execute arbitrary code on the vulnerable host with...

CVE-2020-0604

CVE-2020-0604 is a Visual Studio Code remote code execution vulnerability. According to provided documents, it occurs when VS Code processes environment variables after opening a project, allowing attacker-supplied code to run in the targeted user’s context if they clone a repository and open it ...

CVE-2020-17023

CVE-2020-17023 — Visual Studio Code remote code execution Affected product: Visual Studio Code. Vulnerability: A remote code execution flaw occurs when a user is tricked into opening a malicious package.json; attacker-supplied code runs in the context of the current user. Exploitation requires co...

CVE-2020-17104

CVE-2020-17104 concerns Visual Studio Code JSHint Extension. Root cause per PT-2020-4828: insufficient input validation in the Visual Studio Code editor, enabling a remote attacker to execute arbitrary code via a specially crafted file. The connected document does not specify affected versions or...