Microsoft Visual Studio Code — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Visual Studio Code, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (76)

• CVE-2026-47281 — CVSS 9.6 (critical): Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2025-55319 — CVSS 8.8 (high): Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-41109 — CVSS 8.8 (high): Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio…
• CVE-2026-69320 — CVSS 8.8 (high): Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized…
• CVE-2024-26165 — CVSS 8.8 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2024-43488 — CVSS 8.8 (high): Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform…
• CVE-2026-21518 — CVSS 8.8 (high): Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an…
• CVE-2026-57102 — CVSS 8.8 (high): Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature…
• CVE-2022-30129 — CVSS 8.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2026-70336 — CVSS 8.8 (high): Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a…
• CVE-2026-41613 — CVSS 8.8 (high): Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2020-1416 — CVSS 8.8 (high): An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual…
• CVE-2026-59113 — CVSS 8.8 (high): Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-50520 — CVSS 8.4 (high): Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker…
• CVE-2026-45482 — CVSS 8.4 (high): Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an…
• CVE-2026-69306 — CVSS 8.2 (high): Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2022-21991 — CVSS 8.1 (high): Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
• CVE-2026-21523 — CVSS 8.0 (high): Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a…
• CVE-2025-64660 — CVSS 8.0 (high): Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
• CVE-2021-42322 — CVSS 7.8 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2021-43891 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2022-41034 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2023-21779 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2023-24893 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2018-0597 — CVSS 7.8 (high): Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in…
• CVE-2024-43601 — CVSS 7.8 (high): Visual Studio Code for Linux Remote Code Execution Vulnerability
• CVE-2023-36742 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2019-0728 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka…
• CVE-2019-1414 — CVSS 7.8 (high): An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka…
• CVE-2020-0604 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An…
• CVE-2020-16881 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file…
• CVE-2020-17023 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file…
• CVE-2020-17104 — CVSS 7.8 (high): Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
• CVE-2020-17148 — CVSS 7.8 (high): Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
• CVE-2021-27060 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28457 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28469 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28471 — CVSS 7.8 (high): Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28473 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28475 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-31211 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-31214 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-34479 — CVSS 7.8 (high): Microsoft Visual Studio Spoofing Vulnerability
• CVE-2021-34528 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-34529 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2026-41611 — CVSS 7.8 (high): Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to…
• CVE-2026-47292 — CVSS 7.8 (high): Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges…
• CVE-2026-58650 — CVSS 7.8 (high): Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-69278 — CVSS 7.8 (high): Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-70335 — CVSS 7.8 (high): Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows…
• CVE-2026-40376 — CVSS 7.5 (high): Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2022-41042 — CVSS 7.4 (high): Visual Studio Code Information Disclosure Vulnerability
• CVE-2022-38020 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2025-26631 — CVSS 7.3 (high): Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
• CVE-2022-26921 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2025-24042 — CVSS 7.3 (high): Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
• CVE-2025-24039 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2025-21264 — CVSS 7.1 (high): Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature…
• CVE-2026-48569 — CVSS 7.1 (high): Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-57101 — CVSS 7.1 (high): Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker…
• CVE-2021-28477 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-1639 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2020-16977 — CVSS 7.0 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker…
• CVE-2025-32726 — CVSS 6.8 (medium): Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
• CVE-2023-33144 — CVSS 6.6 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2023-29338 — CVSS 6.6 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2026-47282 — CVSS 6.5 (medium): Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over…
• CVE-2026-47284 — CVSS 6.5 (medium): Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information…
• CVE-2026-47285 — CVSS 6.5 (medium): Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker…
• CVE-2026-47287 — CVSS 6.5 (medium): Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
• CVE-2026-41610 — CVSS 6.3 (medium): Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker…
• CVE-2022-24526 — CVSS 6.1 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2026-45496 — CVSS 5.5 (medium): Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to…
• CVE-2021-26437 — CVSS 5.5 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2025-62453 — CVSS 5.0 (medium): Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security…
• CVE-2021-43908 — CVSS 4.3 (medium): Visual Studio Code Spoofing Vulnerability