Known vulnerabilities in Visual Studio Code

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:vscode:*:*:*:*:*:*:*:*
Total vulnerabilities: 62
Public exploits: 4
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Visual Studio Code Visual Studio Code is affected by 62 known vulnerabilities: 1 critical, 28 high, 17 medium, 16 low Critical High Medium Low

Vulnerabilities (62)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU138173 - Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-57102
CWE-829 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU138172 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-57101
CWE-79 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU138171 - Command injection
CVE-2026-50520
CWE-77 Low
No
No
1.128.1 17.07.2026 SB2026071709
#VU138170 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-45496
CWE-22 Low
No
No
1.128.1 17.07.2026 SB2026071709
#VU138169 - Insufficiently Protected Credentials
CVE-2026-47282
CWE-522 Medium
No
No
1.128.1 17.07.2026 SB2026071709
#VU134269 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-48569
CWE-22 Medium
No
No
1.119.1 10.06.2026 SB20260610109
#VU134268 - Exposure of sensitive information to an unauthorized actor
CVE-2026-47284
CWE-200 Medium
No
No
1.123.2 10.06.2026 SB20260610110
#VU134267 - Improper input validation
CVE-2026-47281
CWE-20 High
No
No
1.123.2 10.06.2026 SB20260610110
#VU134266 - Improper input validation
CVE-2026-40376
CWE-20 High
No
No
1.119.1 10.06.2026 SB20260610109
#VU134265 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-47287
CWE-22 Medium
No
No
1.123.2 10.06.2026 SB20260610110
#VU131371 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE-2026-41109
CWE-74 High
No
No
1.119.1 13.05.2026 SB2026051389
#VU131300 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41611
CWE-79 Low
No
No
1.119.1 13.05.2026 SB2026051309
#VU131299 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-41610
CWE-79 Low
No
No
1.119.1 13.05.2026 SB2026051309
#VU131298 - Session Fixation
CVE-2026-41613
CWE-384 High
No
No
1.119.1 13.05.2026 SB2026051309
#VU122626 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2026-21523
CWE-367 Medium
No
No
1.109.1 10.02.2026 SB20260210107
#VU122622 - Command injection
CVE-2026-21518
CWE-77 High
No
No
1.109.1 10.02.2026 SB20260210107
#VU118338 - Improper Validation of Generative AI Output
CVE-2025-62453
CWE-1426 Low
No
No
- 12.11.2025 SB2025111203
#VU115179 - Command injection
CVE-2025-55319
CWE-77 High
No
No
1.104.0 12.09.2025 SB2025091211
#VU109143 - Files or Directories Accessible to External Parties
CVE-2025-21264
CWE-552 Low
No
No
1.100.1 13.05.2025 SB20250513124
#VU107398 - Improper Access Control
CVE-2025-32726
CWE-284 Low
No
No
1.99.1 12.04.2025 SB2025041203


Showing elements 1 - 20 out of 62