Microsoft Visual Studio Code vulnerabilities

98 CVEs affecting Microsoft Visual Studio Code, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70098, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-41034, published 2022-10-11. High severity, CVSS 7.8. EPSS: 67.5% chance of exploitation in the next 30 days. Visual Studio Code Remote Code Execution Vulnerability
• CVE-2022-30129, published 2022-05-10. High severity, CVSS 8.8. EPSS: 41.3% chance of exploitation in the next 30 days. Visual Studio Code Remote Code Execution Vulnerability
• CVE-2019-0728, published 2019-03-05. High severity, CVSS 7.8. EPSS: 27.7% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
• CVE-2021-43891, published 2021-12-15. High severity, CVSS 7.8. EPSS: 13.8% chance of exploitation in the next 30 days. Visual Studio Code Remote Code Execution Vulnerability
• CVE-2020-1416, published 2020-07-14. High severity, CVSS 8.8. EPSS: 5.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Visual Studio and Visual Studio Code when they load software dependencies, aka 'Visual Studio and Visual Studio Code Elevation of Privilege…
• CVE-2018-0597, published 2018-06-26. High severity, CVSS 7.8. EPSS: 5.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
• CVE-2020-16881, published 2020-09-11. High severity, CVSS 7.8. EPSS: 5.4% chance of exploitation in the next 30 days. <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability…
• CVE-2021-34529, published 2021-07-14. High severity, CVSS 7.8. EPSS: 5.1% chance of exploitation in the next 30 days. Visual Studio Code Remote Code Execution Vulnerability
• CVE-2020-17023, published 2020-10-16. High severity, CVSS 7.8. EPSS: 4.6% chance of exploitation in the next 30 days. <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file. An attacker who successfully exploited the vulnerability…
• CVE-2021-28471, published 2021-04-13. High severity, CVSS 7.8. EPSS: 4.1% chance of exploitation in the next 30 days. Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability

Latest

• CVE-2026-70098, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-102238, published 2026-10-13. Critical severity, CVSS 9.6. EPSS: 0.7% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-102235, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-102234, published 2026-10-13. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-69370, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-102851, published 2026-10-13. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
• CVE-2026-102233, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-102232, published 2026-10-13. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-102231, published 2026-10-13. High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days. Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-102229, published 2026-10-13. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.