Known Vulnerabilities for Visual Studio Code by Microsoft
Listed below are 10 of the newest known vulnerabilities associated with "Visual Studio Code" by "Microsoft".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-70336 json | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute co... | Not Provided | 2026-08-11 | 2026-08-13 |
| CVE-2026-70335 json | Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studi... | Not Provided | 2026-08-11 | 2026-08-13 |
| CVE-2026-69320 json | Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an un... | Not Provided | 2026-08-11 | 2026-08-13 |
| CVE-2026-69306 json | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over... | Not Provided | 2026-08-11 | 2026-08-13 |
| CVE-2026-69278 json | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | Not Provided | 2026-08-11 | 2026-08-13 |
| CVE-2026-65675 json | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security featu... | Not Provided | 2026-08-11 | 2026-08-19 |
| CVE-2026-59113 json | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. | Not Provided | 2026-08-11 | 2026-08-16 |
| CVE-2026-58650 json | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security f... | Not Provided | 2026-08-11 | 2026-08-16 |
| CVE-2026-57102 json | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a se... | Not Provided | 2026-07-14 | 2026-07-15 |
| CVE-2026-57101 json | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthor... | Not Provided | 2026-07-14 | 2026-07-15 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | Visual Studio Code | 2020.5.80290 | |||
| Application | Microsoft | Visual Studio Code | 2020.5.78807 | |||
| Application | Microsoft | Visual Studio Code | 2020.5.0 | |||
| Application | Microsoft | Visual Studio Code | 2020.4.76186 | |||
| Application | Microsoft | Visual Studio Code | 2020.4.74986 | |||
| Application | Microsoft | Visual Studio Code | 2020.3.71659 | |||
| Application | Microsoft | Visual Studio Code | 2020.3.71113 | |||
| Application | Microsoft | Visual Studio Code | 2020.3.69010 | |||
| Application | Microsoft | Visual Studio Code | 2020.2.64397 | |||
| Application | Microsoft | Visual Studio Code | 2020.2.63990 | |||
| Application | Microsoft | Visual Studio Code | 2020.2.63072 | |||
| Application | Microsoft | Visual Studio Code | 2020.2.62710 | |||
| Application | Microsoft | Visual Studio Code | 2020.1.58038 | |||
| Application | Microsoft | Visual Studio Code | 2020.1.57204 | |||
| Application | Microsoft | Visual Studio Code | 2019.9.34911 | |||
| Application | Microsoft | Visual Studio Code | 2019.9.34474 | |||
| Application | Microsoft | Visual Studio Code | 2019.8.30787 | |||
| Application | Microsoft | Visual Studio Code | 2019.8.29288 | |||
| Application | Microsoft | Visual Studio Code | 2019.6.24221 | |||
| Application | Microsoft | Visual Studio Code | 2019.6.22090 |