CVE-2025-21264: Microsoft Visual Studio Code

High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Affected products

• Microsoft Visual Studio Code: before 1.100.1 (fixed in 1.100.1)

Published 2025-05-13. Last modified 2026-06-17.