EUVD-2026-56589
GHSA-29cx-mh6p-wj36
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable injection requiring victim to open malicious content (UI:R, PR:N); full triad impact limited to user session scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft Visual Studio Code allows a network-based attacker to inject and execute arbitrary code on a victim's machine with no prior authentication, provided the victim performs a user interaction - such as opening a malicious workspace, file, or URI. Classified under CWE-94 (Code Injection), the vulnerability carries a CVSS base score of 8.8, reflecting high impact across confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim is running a vulnerable version of Visual Studio Code and that they perform a user interaction - specifically opening or processing attacker-controlled content such as a workspace file, project folder, or crafted document. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 8.8 reflects a genuinely severe vulnerability: network-reachable, low attack complexity, no privileges required, and complete triad impact (C:H/I:H/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious VS Code workspace or file designed to inject code through the vulnerable code-generation path and hosts it on a public repository or sends it via email or chat. A developer opens the workspace in VS Code - a routine action during code review or project onboarding - triggering the injection and executing attacker-controlled code with the privileges of the VS Code process on the developer's workstation. … |
| Remediation | The primary remediation is to apply the Microsoft-released patch referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70336. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: issue an urgent advisory to all development teams prohibiting the opening of untrusted Visual Studio Code workspaces and projects from external sources, and audit current workspace usage logs for suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Visual Studio Code
View allVisual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authent
Visual Studio Code Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Privilege escalation in Microsoft Visual Studio Code allows remote unauthenticated attackers to elevate privileges over
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted c
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check
OS command injection in Visual Studio Code exposes victims to remote code execution when they interact with attacker-con
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from
Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attac
Local code execution in Microsoft Visual Studio Code stems from a command injection flaw (CWE-77) that lets an attacker
Security feature bypass via path traversal in GitHub Copilot and Visual Studio Code allows a local unauthorized attacker
Fail-open security logic in Visual Studio Code permits network-based security feature bypass by an unauthenticated attac
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today