Executive brief
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Affected products
- Microsoft Visual Studio Code
Junglewise Threat Intelligence
CVE-2026-70336: Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a netwo
CVE-2026-70336 · Severity: high · CVSS 8.8 · Published 2026-08-11
Technologies: Microsoft Visual Studio Code. Vendors: Microsoft.
Related threats
- Microsoft Visual Studio Code information disclosure via name resolution
- Microsoft Visual Studio Code credential exposure in GitHub Copilot
- GitHub Copilot and Visual Studio Code command injection
- Microsoft Visual Studio Code security feature bypass via improper failure handling
- Microsoft Visual Studio Code path traversal