CVE-2025-62453: microsoft visual studio code
CVSS: 5.0v3.1MediumAnalyzed
Published 11-11-2025Last modified 13-02-2026
Vulnerability summary
CVE-2025-62453 is a medium (CVSS 5.0) vulnerability in microsoft visual studio code. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.3% of scored vulnerabilities.
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)EPSS score
0.43%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 11-11-2025PublishedVulnerability first disclosed.
- 13-02-2026Last modifiedVulnerability information updated.
Description
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
CVSS metrics
2 scores · 2 sources · 1 versionMedium 5.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:CSourcesAll 2 agree
- NVDNIST5.0MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.01 pp
From 0.42% on 19-09-2026
19-09-202619-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1426Improper Validation of Generative AI OutputThe product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Microsoft1 product
- visual studio code≥ 1.0.0, < 1.105.0 | < 1.105.0
1 vendor · 1 product
