CVE-20XX-?

Microsoft Visual Studio Code CVEs.

Published CVEs affecting Microsoft Visual Studio Code, ranked by exploit odds.

47 CVEs · updated 2026-11-06 04:49 UTC

  1. CVE-2026-21518

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 1% exploit odds Fix listed
  2. CVE-2026-78461

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Disclosure Microsoft Visual Studio Code

    7.4 HIGH 1% exploit odds Fix listed
  3. CVE-2026-47284

    Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 1% exploit odds Fix listed
  4. CVE-2025-55319

    Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 1.0% exploit odds Fix listed
  5. CVE-2026-47285

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  6. CVE-2026-81383

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    7.4 HIGH 0.9% exploit odds Fix listed
  7. CVE-2026-81376

    Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    9.6 CRITICAL 0.9% exploit odds Fix listed
  8. CVE-2026-81381

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  9. CVE-2026-47282

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  10. CVE-2026-69320

    Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 0.9% exploit odds Fix listed
  11. CVE-2026-41109

    Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.8 HIGH 0.9% exploit odds Fix listed
  12. CVE-2026-47281

    Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

    Auth & access Microsoft Visual Studio Code

    9.6 CRITICAL 0.8% exploit odds Fix listed
  13. CVE-2026-57102

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Disclosure Microsoft Visual Studio Code

    8.8 HIGH 0.8% exploit odds Fix listed
  14. CVE-2026-70336

    Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 0.8% exploit odds Fix listed
  15. CVE-2026-47287

    Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 0.8% exploit odds Fix listed
  16. CVE-2025-21264

    Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Microsoft Visual Studio Code

    7.1 HIGH 0.8% exploit odds Fix listed
  17. CVE-2026-21523

    Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

    Other Microsoft Visual Studio Code

    8.0 HIGH 0.8% exploit odds Fix listed
  18. CVE-2026-59113

    Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Auth & access Microsoft Visual Studio Code

    8.8 HIGH 0.8% exploit odds Fix listed
  19. CVE-2026-78462

    Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Auth & access Microsoft Visual Studio Code

    8.8 HIGH 0.8% exploit odds Fix listed
  20. CVE-2026-81377

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 0.8% exploit odds Fix listed
  21. CVE-2025-24039

    Visual Studio Code Elevation of Privilege Vulnerability

    Microsoft Visual Studio Code

    7.3 HIGH 0.7% exploit odds Fix listed
  22. CVE-2025-24042

    Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

    Microsoft Visual Studio Code

    7.3 HIGH 0.7% exploit odds Fix listed
  23. CVE-2026-81380

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft Visual Studio Code

    5.3 MEDIUM 0.7% exploit odds Fix listed
  24. CVE-2026-40376

    Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

    Other Microsoft Visual Studio Code

    7.5 HIGH 0.7% exploit odds Fix listed
  25. CVE-2026-41610

    Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    XSS Microsoft Visual Studio Code

    6.3 MEDIUM 0.6% exploit odds Fix listed
  26. CVE-2025-64660

    Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

    Auth & access Microsoft Visual Studio Code

    8.0 HIGH 0.6% exploit odds Fix listed
  27. CVE-2025-26631

    Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.

    Microsoft Visual Studio Code

    7.3 HIGH 0.6% exploit odds Fix listed
  28. CVE-2026-69306

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  29. CVE-2026-81356

    Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  30. CVE-2026-81378

    Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  31. CVE-2026-81379

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  32. CVE-2026-41613

    Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 0.5% exploit odds Fix listed
  33. CVE-2026-81357

    Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Disclosure Server Microsoft Visual Studio Code

    8.2 HIGH 0.5% exploit odds Fix listed
  34. CVE-2026-70334

    Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.8 HIGH 0.5% exploit odds Fix listed
  35. CVE-2026-57101

    Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    XSS Microsoft Visual Studio Code

    7.1 HIGH 0.5% exploit odds Fix listed
  36. CVE-2026-45496

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Disclosure Microsoft Visual Studio Code

    5.5 MEDIUM 0.5% exploit odds Fix listed
  37. CVE-2026-70335

    Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

    Injection Microsoft Visual Studio Code

    7.8 HIGH 0.5% exploit odds Fix listed
  38. CVE-2025-32726

    Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.

    Microsoft Visual Studio Code

    6.8 MEDIUM 0.5% exploit odds Fix listed
  39. CVE-2026-47292

    Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

    Injection Microsoft Visual Studio Code

    7.8 HIGH 0.4% exploit odds Fix listed
  40. CVE-2025-62453

    Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    5.0 MEDIUM 0.4% exploit odds Fix listed
  41. CVE-2026-41611

    Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.

    Injection Microsoft Visual Studio Code

    7.8 HIGH 0.4% exploit odds Fix listed
  42. CVE-2026-102231

    Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.7 HIGH 0.4% exploit odds Fix listed
  43. CVE-2026-48569

    Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.1 HIGH 0.4% exploit odds Fix listed
  44. CVE-2026-50520

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

    Injection Microsoft Visual Studio Code

    8.4 HIGH 0.4% exploit odds Fix listed
  45. CVE-2026-45482

    Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Disclosure Microsoft Visual Studio Code

    8.4 HIGH 0.3% exploit odds Fix listed
  46. CVE-2026-58650

    Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Auth & access Microsoft Visual Studio Code

    7.8 HIGH 0.3% exploit odds Fix listed
  47. CVE-2026-69278

    Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Other Microsoft Visual Studio Code

    7.8 HIGH 0.3% exploit odds Fix listed

All CVEs affecting Microsoft Visual Studio Code that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.