PatchTheCVEvisual studio code vulnerabilities and fixes
Recent CVEs affecting visual studio code, with upgrade or downgrade steps. 8 tracked.
Also searched as: visualstudiocode.
visual studio code has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2026-08-11. Highest priority: CVE-2026-69320 (score 50/100).
- CVE-2026-69320 HIGH 8.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co
- CVE-2026-70336 HIGH 8.8 UPGRADE Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacke
- CVE-2026-59113 HIGH 8.8 UPGRADE Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- CVE-2026-69306 HIGH 8.2 UPGRADE Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a securi
- CVE-2026-47285 MEDIUM 6.5 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allo
- CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
- CVE-2026-58650 HIGH 7.8 UPGRADE Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypa
- CVE-2026-69278 HIGH 7.8 UPGRADE Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature loc
FAQ
How do I fix visual studio code vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is visual studio code being exploited right now?
None of the tracked visual studio code CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which visual studio code CVE should I patch first?
CVE-2026-69320 currently ranks highest (50/100): Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co.