Microsoft Visual Studio Code — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Visual Studio Code, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (63)

• CVE-2026-47281 — CVSS 9.6 (critical): Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-41613 — CVSS 8.8 (high): Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2024-26165 — CVSS 8.8 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2025-55319 — CVSS 8.8 (high): Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2024-43488 — CVSS 8.8 (high): Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform…
• CVE-2020-1416 — CVSS 8.8 (high): An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual…
• CVE-2026-41109 — CVSS 8.8 (high): Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio…
• CVE-2026-21518 — CVSS 8.8 (high): Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an…
• CVE-2022-30129 — CVSS 8.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2026-45482 — CVSS 8.4 (high): Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose…
• CVE-2022-21991 — CVSS 8.1 (high): Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
• CVE-2025-64660 — CVSS 8.0 (high): Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
• CVE-2026-21523 — CVSS 8.0 (high): Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a…
• CVE-2021-28475 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-31211 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-31214 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-34479 — CVSS 7.8 (high): Microsoft Visual Studio Spoofing Vulnerability
• CVE-2021-34528 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-34529 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-42322 — CVSS 7.8 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2021-43891 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2022-41034 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2023-21779 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2023-24893 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28469 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2019-0728 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka…
• CVE-2019-1414 — CVSS 7.8 (high): An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka…
• CVE-2020-0604 — CVSS 7.8 (high): A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An…
• CVE-2020-16881 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file…
• CVE-2020-17023 — CVSS 7.8 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file…
• CVE-2020-17104 — CVSS 7.8 (high): Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
• CVE-2020-17148 — CVSS 7.8 (high): Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
• CVE-2021-27060 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28457 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2018-0597 — CVSS 7.8 (high): Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in…
• CVE-2021-28471 — CVSS 7.8 (high): Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-28473 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2023-36742 — CVSS 7.8 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2024-43601 — CVSS 7.8 (high): Visual Studio Code for Linux Remote Code Execution Vulnerability
• CVE-2026-41611 — CVSS 7.8 (high): Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to…
• CVE-2026-47292 — CVSS 7.8 (high): Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges…
• CVE-2026-40376 — CVSS 7.5 (high): Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
• CVE-2022-41042 — CVSS 7.4 (high): Visual Studio Code Information Disclosure Vulnerability
• CVE-2025-24039 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2022-26921 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2025-26631 — CVSS 7.3 (high): Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.
• CVE-2025-24042 — CVSS 7.3 (high): Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability
• CVE-2022-38020 — CVSS 7.3 (high): Visual Studio Code Elevation of Privilege Vulnerability
• CVE-2026-48569 — CVSS 7.1 (high): Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2025-21264 — CVSS 7.1 (high): Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature…
• CVE-2021-28477 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2021-1639 — CVSS 7.0 (high): Visual Studio Code Remote Code Execution Vulnerability
• CVE-2020-16977 — CVSS 7.0 (high): <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker…
• CVE-2025-32726 — CVSS 6.8 (medium): Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.
• CVE-2023-33144 — CVSS 6.6 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2023-29338 — CVSS 6.6 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2026-47284 — CVSS 6.5 (medium): Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information…
• CVE-2026-47287 — CVSS 6.5 (medium): Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
• CVE-2026-41610 — CVSS 6.3 (medium): Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker…
• CVE-2022-24526 — CVSS 6.1 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2021-26437 — CVSS 5.5 (medium): Visual Studio Code Spoofing Vulnerability
• CVE-2025-62453 — CVSS 5.0 (medium): Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security…
• CVE-2021-43908 — CVSS 4.3 (medium): Visual Studio Code Spoofing Vulnerability