visual_studio_code vulnerabilities
CVEs whose affected-version data names the visual_studio_code package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
48 CVEsRSS
CVE-2026-50520High· 8.4Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
CVE-2026-57101High· 7.1Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-57102High· 8.8Visual Studio Code Security Feature Bypass Vulnerability
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-47282Medium· 6.5Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-45496Medium· 5.5Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-47287Medium· 6.5Visual Studio Code Tampering Vulnerability
Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.
CVE-2026-40376High· 7.5Visual Studio Code Elevation of Privilege Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-47284Medium· 6.5Visual Studio Code Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
CVE-2026-47281Critical· 9.6Visual Studio Code Elevation of Privilege Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-48569High· 7.1Visual Studio Code Security Feature Bypass Vulnerability
Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-41109High· 8.8GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
CVE-2022-26921High· 7.3Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-21991High· 8.1Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
CVE-2021-43908Medium· 4.3PoCVisual Studio Code Spoofing Vulnerability
Visual Studio Code Spoofing Vulnerability
CVE-2021-43891High· 7.8PoCVisual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34529High· 7.80dayVisual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34528High· 7.8Visual Studio Code Remote Code Execution Vulnerability
Visual Studio Code Remote Code Execution Vulnerability
CVE-2021-34479High· 7.8Microsoft Visual Studio Spoofing Vulnerability
Microsoft Visual Studio Spoofing Vulnerability