Microsoft Python vulnerabilities

6 CVEs affecting Microsoft Python, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-54981, published 2026-08-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-1171, published 2020-05-21. High severity, CVSS 8.8. EPSS: 5.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the…
• CVE-2020-1192, published 2020-05-21. High severity, CVSS 7.8. EPSS: 4.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file. An attacker who successfully exploited the vulnerability…
• CVE-2024-49050, published 2024-11-12. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. Visual Studio Code Python Extension Remote Code Execution Vulnerability
• CVE-2020-17163, published 2023-12-29. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Visual Studio Code Python Extension Remote Code Execution Vulnerability
• CVE-2025-49714, published 2025-07-08. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
• CVE-2026-54981, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.