CVE-20XX-?
agent?

Microsoft Visual Studio Code CVEs.

Published CVEs affecting Microsoft Visual Studio Code, ranked by exploit odds.

87 CVEs · updated 2026-11-06 16:24 UTC

Reset all
  1. CVE-2022-41034

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 67% exploit odds Fix listed
  2. CVE-2022-30129

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    8.8 HIGH 42% exploit odds Fix listed
  3. CVE-2019-0728

    A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.

    Microsoft Visual Studio Code

    7.8 HIGH 28% exploit odds Fix listed
  4. CVE-2021-43891

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 13% exploit odds Fix listed
  5. CVE-2018-0597

    Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

    Microsoft Visual Studio Code

    7.8 HIGH 5% exploit odds Fix listed
  6. CVE-2020-16881

    <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p> <p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>

    Microsoft Visual Studio Code

    7.8 HIGH 5% exploit odds Fix listed
  7. CVE-2021-34529

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 5% exploit odds Fix listed
  8. CVE-2020-17023

    <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p> <p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>

    Microsoft Visual Studio Code

    7.8 HIGH 5% exploit odds Fix listed
  9. CVE-2021-28471

    Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 4% exploit odds Fix listed
  10. CVE-2020-17148

    Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 4% exploit odds Fix listed
  11. CVE-2020-17104

    Visual Studio Code JSHint Extension Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 4% exploit odds Fix listed
  12. CVE-2020-0604

    A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opened the integrated terminal. The update address the vulnerability by modifying the way Visual Studio Code handles environment variables.

    Microsoft Visual Studio Code

    7.8 HIGH 4% exploit odds Fix listed
  13. CVE-2021-34479

    Microsoft Visual Studio Spoofing Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  14. CVE-2020-16977

    <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p> <p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>

    Microsoft Visual Studio Code

    7.0 HIGH 3% exploit odds Fix listed
  15. CVE-2021-27060

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  16. CVE-2021-34528

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  17. CVE-2021-31214

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  18. CVE-2021-43908

    Visual Studio Code Spoofing Vulnerability

    Microsoft Visual Studio Code

    4.3 MEDIUM 3% exploit odds Fix listed
  19. CVE-2021-28457

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  20. CVE-2021-28469

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  21. CVE-2021-28473

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  22. CVE-2021-28475

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  23. CVE-2021-31211

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 3% exploit odds Fix listed
  24. CVE-2022-41042

    Visual Studio Code Information Disclosure Vulnerability

    Microsoft Visual Studio Code

    7.4 HIGH 2% exploit odds Fix listed
  25. CVE-2023-21779

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 2% exploit odds No fix listed
  26. CVE-2021-26437

    Visual Studio Code Spoofing Vulnerability

    Microsoft Visual Studio Code

    5.5 MEDIUM 2% exploit odds Fix listed
  27. CVE-2021-28477

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.0 HIGH 2% exploit odds Fix listed
  28. CVE-2022-21991

    Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    8.1 HIGH 2% exploit odds No fix listed
  29. CVE-2024-26165

    Visual Studio Code Elevation of Privilege Vulnerability

    Microsoft Visual Studio Code

    8.8 HIGH 2% exploit odds Fix listed
  30. CVE-2022-24526

    Visual Studio Code Spoofing Vulnerability

    Microsoft Visual Studio Code

    6.1 MEDIUM 2% exploit odds No fix listed
  31. CVE-2026-21518

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 1% exploit odds Fix listed
  32. CVE-2023-33144

    Visual Studio Code Spoofing Vulnerability

    Microsoft Visual Studio Code

    6.6 MEDIUM 1% exploit odds Fix listed
  33. CVE-2024-43488

    Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

    Auth & access Microsoft Visual Studio Code

    8.8 HIGH 1% exploit odds Fix listed
  34. CVE-2023-24893

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 1% exploit odds Fix listed
  35. CVE-2019-1414

    An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.

    Microsoft Visual Studio Code

    7.8 HIGH 1% exploit odds Fix listed
  36. CVE-2024-43601

    Visual Studio Code for Linux Remote Code Execution Vulnerability

    Injection Microsoft Visual Studio Code

    7.8 HIGH 1% exploit odds Fix listed
  37. CVE-2022-38020

    Visual Studio Code Elevation of Privilege Vulnerability

    Microsoft Visual Studio Code

    7.3 HIGH 1% exploit odds No fix listed
  38. CVE-2026-78461

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Disclosure Microsoft Visual Studio Code

    7.4 HIGH 1% exploit odds Fix listed
  39. CVE-2026-47284

    Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 1% exploit odds Fix listed
  40. CVE-2023-36742

    Visual Studio Code Remote Code Execution Vulnerability

    Microsoft Visual Studio Code

    7.8 HIGH 1% exploit odds Fix listed
  41. CVE-2025-55319

    Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 1.0% exploit odds Fix listed
  42. CVE-2026-47285

    Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Injection Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  43. CVE-2026-81383

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    7.4 HIGH 0.9% exploit odds Fix listed
  44. CVE-2026-81376

    Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    9.6 CRITICAL 0.9% exploit odds Fix listed
  45. CVE-2023-29338

    Visual Studio Code Spoofing Vulnerability

    Microsoft Visual Studio Code

    6.6 MEDIUM 0.9% exploit odds Fix listed
  46. CVE-2026-81381

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Other Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  47. CVE-2026-47282

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Disclosure Microsoft Visual Studio Code

    6.5 MEDIUM 0.9% exploit odds Fix listed
  48. CVE-2026-69320

    Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Injection Microsoft Visual Studio Code

    8.8 HIGH 0.9% exploit odds Fix listed
  49. CVE-2026-41109

    Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

    Other Microsoft Visual Studio Code

    8.8 HIGH 0.9% exploit odds Fix listed
  50. CVE-2026-47281

    Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

    Auth & access Microsoft Visual Studio Code

    9.6 CRITICAL 0.8% exploit odds Fix listed

All CVEs affecting Microsoft Visual Studio Code that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.