Executive brief
Microsoft Visual Studio Code, a widely used code editor for software development, contains a security vulnerability that could allow an attacker to run unauthorized commands on a user's computer. If exploited, this could lead to a full system compromise, allowing an attacker to steal sensitive data, modify files, or disrupt development operations. Users are advised to update to the latest version of the software to mitigate this risk.
Technical details
A command injection vulnerability (CWE-77) exists in Microsoft Visual Studio Code due to the improper neutralization of special elements used in a command. An attacker can exploit this flaw to execute arbitrary code locally on the host system. The vulnerability has a CVSS 3.1 score of 8.4, reflecting high impact on confidentiality, integrity, and availability. While the attack vector is local, it requires no prior privileges or user interaction to execute. Microsoft has addressed this issue in version 1.128.1.
Affected products
- Microsoft Visual Studio Code 1.0.0 to 1.128.1
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD