SB20260812229 - Multiple vulnerabilities in Visual Studio Code

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260812229

SB20260812229 - Multiple vulnerabilities in Visual Studio Code

Published: August 12, 2026

Security Bulletin ID SB20260812229
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 88% Medium 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-58650)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to authorization bypass through user-controlled key in the Workspace Trust feature when processing content from an untrusted workspace. A remote attacker can trick the victim into opening an untrusted workspace to bypass a security feature.

Successful exploitation can allow commands or code from an untrusted workspace to run without the user first granting trust.


2) Missing Authorization (CVE-ID: CVE-2026-59113)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to missing authorization in operating-system protocol handler launching in Visual Studio Code when retrieving attacker-controlled web content. A remote attacker can host a specially crafted web page and convince a user to have the application retrieve it to execute arbitrary code.

User interaction is required.


3) Command injection (CVE-ID: CVE-2026-47285)

CWE-ID: CWE-77 - Command injection

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to command injection in Visual Studio Code when opening a malicious file. A remote attacker can entice a user to open a crafted file to disclose sensitive information.

User interaction is required to open a crafted file in Visual Studio Code.


4) OS Command Injection (CVE-ID: CVE-2026-69320)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to command injection in Visual Studio Code when opening an attacker-supplied link or web page. A remote attacker can craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code to execute arbitrary code.

User interaction is required to open the attacker-supplied link or web page, and successful exploitation occurs in the user's connected development environment.


5) Incorrect authorization (CVE-ID: CVE-2026-69278)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to incorrect authorization in the Workspace Trust feature when opening an untrusted workspace. A remote attacker can trick the victim into opening an untrusted workspace to bypass a security feature.

Successful exploitation can allow content from an untrusted workspace to run commands or code without the user first granting trust.


6) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-69306)

CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass a security feature.

The vulnerability exists due to not failing securely ('failing open') in the Visual Studio Code agent network access restrictions when handling outbound connection policy enforcement. A remote attacker can trigger this condition to bypass a security feature.

User interaction is required for exploitation.


7) OS Command Injection (CVE-ID: CVE-2026-70335)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to elevate privileges.

The vulnerability exists due to command injection in GitHub Copilot and Visual Studio Code AI agent content processing when processing attacker-controlled content. A remote attacker can embed malicious instructions in a web page, repository file, or tool response to elevate privileges.

User interaction is required to run the agent against the crafted content, and the injected instructions may cause commands to run without prompting for confirmation.


8) Code Injection (CVE-ID: CVE-2026-70336)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of generation of code ('code injection') in Visual Studio Code when opening an attacker-supplied link or web page. A remote attacker can craft a malicious link or web page and use social engineering to convince a user to open it to execute arbitrary code.

User interaction is required to open the attacker-supplied link, and code execution occurs in the user's connected development environment.


Remediation

Install update from vendor's website.

References