VS
Product
Visual Studio Code
98
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 5High 73Medium 19Low 1
Watch
Add Visual Studio Code to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-17104 | 7.8 | Nov 11 | Visual Studio Code JSHint Extension Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2020-17023 | 7.8 | Oct 16 | <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file Affected: All versions, or not specified |
| CVE-2020-16881 | 7.8 | Sep 11 | <p>A remote code execution vulnerability exists in Visual Studio Code when a user is tricked into opening a malicious 'package.json' file Affected: before 1.48.1 |
| CVE-2020-0604 | 7.8 | Aug 17 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project Affected: before 0.24.0 |
| CVE-2019-1414 | 7.8 | Jan 24 | An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege… Affected: before 1.39 |
| CVE-2019-0728 | 7.8 | Mar 5 | A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution… Affected: All versions, or not specified |
| CVE-2018-0597 | 7.8 | Jun 26 | Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory Affected: All versions, or not specified |
| CVE-2026-102231 | 7.7 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2026-81381 | 7.5 | Sep 8 | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-102234 | 7.4 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2026-81383 | 7.4 | Sep 8 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2026-78461 | 7.4 | Sep 8 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.136.2 |
| CVE-2022-41042 | 7.4 | Oct 11 | Visual Studio Code Information Disclosure Vulnerability Affected: 1.0.0 before 1.72.1 |
| CVE-2025-26631 | 7.3 | Mar 11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally Affected: before 1.98.0 |
| CVE-2025-24042 | 7.3 | Feb 11 | Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability Affected: before 1.97.1 |
| CVE-2025-24039 | 7.3 | Feb 11 | Visual Studio Code Elevation of Privilege Vulnerability Affected: before 1.97.1 |
| CVE-2022-38020 | 7.3 | Sep 13 | Visual Studio Code Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2022-26921 | 7.3 | Apr 15 | Visual Studio Code Elevation of Privilege Vulnerability Affected: 1.0.0 before 1.66.2 |
| CVE-2025-21264 | 7.1 | May 13 | Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally Affected: before 1.100.1 |
| CVE-2026-102232 | 7.0 | Oct 13 | Visual Studio Code Security Feature Bypass Vulnerability Affected: 1.0.0 before 1.141.1 |
| CVE-2021-28477 | 7.0 | Apr 13 | Visual Studio Code Remote Code Execution Vulnerability Affected: before 1.55.2 |
| CVE-2021-1639 | 7.0 | Feb 25 | Visual Studio Code Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2020-16977 | 7.0 | Oct 16 | <p>A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads a Jupyter notebook file Affected: All versions, or not specified |