Visual Studio Code CVE-2023-21779

HIGH

Deserialization of Untrusted Data (CWE-502)

2023-01-10 secure@microsoft.com

RCE Deserialization Visual Studio Code

7.8

CVSS 3.1 · Vendor: microsoft

Share

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Jan 10, 2023 - 22:15 cve.org

HIGH 7.8

DescriptionCVE.org

Visual Studio Code Remote Code Execution Vulnerability

AnalysisAI

Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. Affected products include: Microsoft Visual Studio Code.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Visual Studio Code

View all

CVE-2022-41034 HIGH Act Now POC

Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent

CVE-2022-30129 HIGH This Week POC

Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e

CVE-2026-47281 CRITICAL Act Now

Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over

CVE-2026-57102 HIGH This Week

Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c

CVE-2026-41109 HIGH This Week

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and

CVE-2024-43488 CRITICAL Act Now

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac

CVE-2026-50520 HIGH This Week

Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker

CVE-2026-45482 HIGH This Week

Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker

CVE-2026-40376 HIGH This Week

Privilege escalation in Microsoft Visual Studio Code versions 1.0.0 through 1.119.0 allows remote unauthenticated attack

CVE-2026-47292 HIGH This Week

Local privilege elevation in Microsoft Visual Studio Code allows an unprivileged attacker to gain higher privileges on a

CVE-2026-41611 HIGH This Week

Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthoriz

CVE-2026-21518 HIGH This Week

GitHub Copilot and Visual Studio Code are vulnerable to command injection attacks that allow unauthenticated attackers t

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

CVE-2020-10189 CRITICAL POC

CVE-2019-18935 CRITICAL POC

CVE-2015-7450 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

CVE-2021-42237 CRITICAL POC

CVE-2025-24016 CRITICAL POC

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2025-53770 CRITICAL POC

CVE-2020-7961 CRITICAL POC

Share

CVE-2023-21779 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy