Microsoft Visual Studio Code vulnerabilities, page 2
99 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio Code, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-28473microsoftvisual studio code
EPSS score2.71%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-28469microsoftvisual studio codeEPSS score2.71%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-28471microsoftvisual studio codeEPSS score4.08%
Remote Development Extension for Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-28477microsoftvisual studio codeEPSS score2.30%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-28457microsoftvisual studio codeEPSS score2.71%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-34529microsoftvisual studio codeEPSS score5.14%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-34528microsoftvisual studio codeEPSS score3.15%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-34479microsoftvisual studio codeEPSS score3.43%
Microsoft Visual Studio Spoofing VulnerabilityCVE-2025-21264microsoftmicrosoft visual studio code copilot chat extension+1EPSS score0.79%
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2025-55319microsoftvisual studio codeEPSS score0.92%
Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2025-62453microsoftvisual studio codeEPSS score0.43%
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2025-26631microsoftvisual studio codeEPSS score0.57%
Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.CVE-2025-24039microsoftvisual studio codeEPSS score0.76%
Visual Studio Code Elevation of Privilege VulnerabilityCVE-2025-24042microsoftvisual studio code+1EPSS score0.71%
Visual Studio Code JS Debug Extension Elevation of Privilege VulnerabilityCVE-2025-64660microsoftvisual studio codeEPSS score0.56%
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.CVE-2025-32726microsoftvisual studio codeEPSS score0.45%
Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.CVE-2020-16977microsoftpython extension for visual studio code+1EPSS score3.35%
<p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.</p>
<p>The update addresses the vulnerability by modifying the way Visual Studio Code Python extension renders notebook content.</p>CVE-2020-16881microsoftvisual studio codeEPSS score5.37%
<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p>
<p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>CVE-2020-1416microsoftazure_storage_explorer+8EPSS score5.86%
An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege Vulnerability'.CVE-2020-1192microsoftpython+1EPSS score4.25%
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to convince a target to open a specially crafted file in Visual Studio Code with the Python extension installed.
The update address the vulnerability by modifying the way Visual Studio Code Python extension enforces user settings.