Microsoft Visual Studio Code vulnerabilities, page 3
99 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio Code, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-0604microsoftvisual studio code
EPSS score3.62%
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opened the integrated terminal.
The update address the vulnerability by modifying the way Visual Studio Code handles environment variables.CVE-2020-17104microsoftvisual studio codeEPSS score3.83%
Visual Studio Code JSHint Extension Remote Code Execution VulnerabilityCVE-2020-17023microsoftvisual studio codeEPSS score4.62%
<p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code. Attacker-specified code would execute when the target opens the malicious 'package.json' file.</p>
<p>The update address the vulnerability by modifying the way Visual Studio Code handles JSON files.</p>CVE-2020-17148microsoftvisual studio code+1EPSS score3.97%
Visual Studio Code Remote Development Extension Remote Code Execution VulnerabilityCVE-2022-21991microsoftvisual studio codeEPSS score2.07%
Visual Studio Code Remote Development Extension Remote Code Execution VulnerabilityCVE-2022-41042microsoftvisual studio codeEPSS score2.47%
Visual Studio Code Information Disclosure VulnerabilityCVE-2022-41034microsoftvisual studio codeEPSS score67.47%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2022-26921microsoftvisual studio codeEPSS score0.60%
Visual Studio Code Elevation of Privilege VulnerabilityCVE-2022-38020microsoftvisual studio codeEPSS score1.07%
Visual Studio Code Elevation of Privilege VulnerabilityCVE-2022-24526microsoftvisual studio codeEPSS score1.61%
Visual Studio Code Spoofing VulnerabilityCVE-2022-30129microsoftvisual studio codeEPSS score41.32%
Visual Studio Code Remote Code Execution VulnerabilityCVE-2024-26165microsoftvisual studio codeEPSS score1.92%
Visual Studio Code Elevation of Privilege VulnerabilityCVE-2024-43488microsoftvisual studio codeEPSS score1.23%
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.CVE-2024-43601microsoftvisual studio code+1EPSS score1.09%
Visual Studio Code for Linux Remote Code Execution VulnerabilityCVE-2019-1414microsoftvisual studio codeEPSS score1.09%
An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.CVE-2019-0728microsoftvisual studio codeEPSS score27.71%
A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.CVE-2026-21523microsoftmicrosoft visual studio code copilot chat extension+1EPSS score0.78%
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.CVE-2026-21518microsoftmicrosoft visual studio code copilot chat extension+1EPSS score1.46%
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-40376microsoftvisual studio codeEPSS score0.68%
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.CVE-2026-59113microsoftvisual studio codeEPSS score0.76%
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.