Visual Studio Code vulnerabilities
17 known vulnerabilities in Visual Studio Code from Microsoft. 17 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.3 High severity
Visual Studio Code: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 8.6 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 8.8 High severity
Visual Studio Code: User Interface (UI) Misrepresentation of Critical Information
User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 9.6 Critical severity
Visual Studio Code: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Visual Studio Code: Reliance on Untrusted Inputs in a Security Decision
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 8.2 High severity
Visual Studio Code: Inconsistent Interpretation of HTTP Requests
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 7.4 High severity
Visual Studio Code: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 7.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 8.8 High severity
Visual Studio Code: Exposure of Sensitive Information to an Unauthorized Actor
Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 8.4 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
- 8.4 High severity
Microsoft Visual Studio Code CoPilot Chat…: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- 8.8 High severity
Microsoft Visual Studio Code CoPilot Chat…: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
- 9.8 Critical severity
Visual Studio Code: Missing Authentication for Critical Functionality
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.