ZDI-26-253
HIGH 7.8
Published
Apr 02, 2026
Microsoft Visual Studio Code mcp.json Command Injection Remote Code Execution Vulnerability
Microsoft
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Visual Studio Code. User interaction is required to exploit this vulnerability in that the target open a malicious project. The ZDI has assigned a CVSS rating of 7.8.