Executive brief
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Affected products
- Microsoft Visual Studio Code
Junglewise Threat Intelligence
CVE-2026-47285: Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to
CVE-2026-47285 · Severity: medium · CVSS 6.5 · Published 2026-08-11
Technologies: Microsoft Visual Studio Code. Vendors: Microsoft.
Related threats
- Microsoft Visual Studio Code information disclosure via name resolution
- Microsoft Visual Studio Code credential exposure in GitHub Copilot
- GitHub Copilot and Visual Studio Code command injection
- Microsoft Visual Studio Code security feature bypass via improper failure handling
- Microsoft Visual Studio Code path traversal