Catalog / Visual Studio Code

Visual Studio Code security advisories

All 65 advisories Visual Studio Code has published with an identifier, newest first. Severity is the one its publisher assigned, and the fix is the release the publisher named. Nothing on this page is our judgement.

Advisories
65 65 carry a CVE
critical
2
high
49
medium
12
low
2
Fix in the archive
0 of 65 matched to a release
Oldest
25 May 2022 4.4 years ago

65 of these point at a version older than anything the archive holds, so there is no release page to link. That is a gap in what was collected, not evidence that the fix does not exist. This page is a copy of what the publisher published, kept for reference. The authoritative source for a security question is the publisher, and an advisory missing from here is not evidence that none exists. What this page does and does not tell you sets out the limits in full.

Newest first

Every product
CVE-2026-102238critical

Path Traversal and Workspace Trust Bypass

GHSA-pc77-xwc5-p6jpFixed in 1.141.1, not held here
CVE-2026-102232high

Remote Code Execution via Custom Hook Edits in the Copilot Harness

GHSA-fq62-m6f5-c7h9Fixed in 1.141.1, not held here
CVE-2026-102235high

Remote Code Execution Vulnerability

GHSA-2j43-g4qc-7fc4Fixed in 1.141.1, not held here
CVE-2026-102234high

Workspace Trust Bypass via Terminal Allowed Link Schemes Setting

GHSA-vmmp-977m-xvwxFixed in 1.141.1, not held here
CVE-2026-102233high

Workspace Trust Bypass via Terminal Relaunch and Reuse

GHSA-vpr6-4m2g-43cxFixed in 1.141.1, not held here
CVE-2026-102231high

Security Feature Bypass via Azure DevOps Code Search Endpoint Override

GHSA-m8rw-hr26-pw53Fixed in 1.141.1, not held here
CVE-2026-102229medium

Information Disclosure via Remote Webview Resource Path Traversal

GHSA-89cr-6h4p-hpx9Fixed in 1.141.1, not held here
CVE-2026-102851medium

Security Feature Bypass via Shared MCP Sandbox Permission Approvals

GHSA-qghm-w43w-vx8vFixed in 1.141.1, not held here
CVE-2026-70098high

Remote Code Execution via Skipped Workspace Trust

GHSA-r2p5-jgfw-r5vwFixed in 1.141.1, not held here
CVE-2026-69370high

Remote Code Execution via Workspace-injected Error Notification Link

GHSA-xf67-g42g-pg73Fixed in 1.141.1, not held here
CVE-2026-78461high

Security Feature Bypass via Notebooks

GHSA-86hw-69fm-2wc6Fixed in 1.136.2, not held here
CVE-2026-81356high

Trusted URL Validation Security Feature Bypass

GHSA-2mjm-fqwf-jq98Fixed in 1.136.2, not held here
CVE-2026-70334high

Visual Studio Code Restricted Mode bypass via nested configuration objects

GHSA-q2f8-hh8x-wpc2Fixed in 1.136.2, not held here
CVE-2026-81376critical

Visual Studio Code Workspace Trust bypass through attacker-controlled services

GHSA-r2gr-w3c8-wvqvFixed in 1.136.2, not held here
CVE-2026-81379high

Agent Network Filter Bypass Vulnerability

GHSA-hr37-8jwr-q8p8Fixed in 1.136.2, not held here
CVE-2026-78462high

Remote code execution through workspace-configured remote agent host connections

GHSA-2cmq-rv52-5rf6Fixed in 1.136.2, not held here
CVE-2026-81383high

Visual Studio Code webview resource path containment bypass

GHSA-x5qc-gqm7-93qpFixed in 1.136.2, not held here
CVE-2026-81381medium

Azure DevOps access token disclosure through GitHub Copilot Chat workspace settings

GHSA-rvgr-2w56-2j67Fixed in 1.136.2, not held here
CVE-2026-81380medium

Information Disclosure through Automatic Remote Image Fetch in Chat

GHSA-vww8-mqc2-4x8vFixed in 1.136.2, not held here
CVE-2026-81377medium

Visual Studio Code MCP gallery metadata path traversal

GHSA-g6p5-6xp8-5jwgFixed in 1.136.2, not held here
CVE-2026-81357high

Agent Network Filter Security Feature Bypass

GHSA-4xcg-6mm5-hj26Fixed in 1.136.2, not held here
CVE-2026-81378high

Agent Network Filter Security Feature Bypass

GHSA-4gv7-q2x8-32p8Fixed in 1.136.2, not held here
CVE-2026-69306high

Agent network filter bypass via IPv4-mapped IPv6 literals

GHSA-6xp2-9cj3-f488Fixed in 1.132.1, not held here
CVE-2026-59113high

Fetch Web Page OS protocol handler remote code execution

GHSA-36qf-jgq9-4m6jFixed in 1.132.1, not held here
CVE-2026-58650high

TerminalInstance._createProcess() - Local RCE via extensions.json recommendation link

GHSA-h6v9-3cqc-v234Fixed in 1.132.1, not held here
CVE-2026-69320high

Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload

GHSA-h29r-p8vr-4vfmFixed in 1.132.1, not held here
CVE-2026-69278high

TerminalInstance._createProcess - Workspace Trust bypass via terminal waitOnExit

GHSA-h9j4-x76r-fvj4Fixed in 1.132.1, not held here
CVE-2026-70335high

Copilot Custom Agent Hook Remote Code Execution Vulnerability

GHSA-w79w-rj9h-vg4fFixed in 1.132.1, not held here
CVE-2026-70336high

Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS

GHSA-fp6w-v29h-43rjFixed in 1.132.1, not held here
CVE-2026-47285medium

Information disclosure vulnerability

GHSA-vcpf-2mpp-vx3vFixed in 1.132.1, not held here
CVE-2026-65675high

Copilot Chat Security Feature Bypass Vulnerability

GHSA-3hjg-cwxj-qfc6Fixed in 1.132.1, not held here
CVE-2026-57102high

Remote Code Execution Vulnerability

GHSA-v282-cxqj-xgj4Fixed in 1.128.1, not held here
CVE-2026-57101high

Workspace Trust Security Feature Bypass Vulnerability

GHSA-9mw4-h26x-gfxwFixed in 1.128.1, not held here
CVE-2026-47282high

Secret exfiltration vulnerability

GHSA-wr9x-42j2-jvh3Fixed in 1.128.1, not held here
CVE-2026-47281high

Unconfirmed Remote Host Connection via Workspace File

GHSA-5j3g-c7qg-xfvxFixed in 1.123.1, not held here
CVE-2026-45482low

Auto-Approved File Write via Unconfirmed Environment-Variable Path Redirection

GHSA-c82g-9gj4-hxp2Fixed in 1.123.1, not held here
CVE-2026-47287medium

Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip)

GHSA-hgwg-xqr5-q87fFixed in 1.123.1, not held here
CVE-2026-47284high

GitHubCredentialProvider - Regex substring host match sends Basic-auth tokens

GHSA-qcxw-jfff-cxpcFixed in 1.123.1, not held here
CVE-2026-41610medium

Remote Code Execution Vulnerability with Jupyter notebook markdown rendering in untrusted workspaces

GHSA-v32f-vf7g-ggmwFixed in 1.119.1, not held here
CVE-2026-41611medium

Remote Code Execution Vulnerability in webviews

GHSA-5vj9-2628-2rm4Fixed in 1.119.1, not held here
CVE-2026-41109high

Apply patch sensitive file workaround

GHSA-rg3f-8xq5-hwh6
CVE-2026-41613high

MCP Deeplink Install Lacked Essential Information

GHSA-9f6c-63gp-pwpf
CVE-2026-21518low

Workspace trust for MCP servers

GHSA-6xq8-9qf3-p6qvFixed in 1.109.1, not held here
CVE-2026-21523high

apply_patch sensitive file bypass

GHSA-w79r-pmq3-8v4fFixed in 0.37.3, not held here
CVE-2026-21523high

URL unicode escaping

GHSA-g84c-g4wq-2pwpFixed in 0.37.3, not held here
CVE-2026-21523high

Terminal auto replies restriction

GHSA-3pwg-f3hj-wp8pFixed in 1.109.1, not held here
CVE-2025-21264high

Security Feature Bypass Vulnerability

GHSA-742r-ggwg-vqxmFixed in 1.100.1, not held here
CVE-2025-20570high

Remote Code Execution Vulnerability

GHSA-hwrx-jgf2-74hwFixed in 1.99.1, not held here
CVE-2025-24039high

Elevation of Privilege Vulnerability

GHSA-532g-4pv9-25f2Fixed in 1.97.1, not held here
CVE-2025-24042medium

Elevation of Privilege Vulnerability

GHSA-f85p-3684-2g3jFixed in 1.97.1, not held here
CVE-2024-43601high

Visual Studio Code for Linux Remote Code Execution Vulnerability

GHSA-g56j-w527-8x6fFixed in 1.94.1, not held here
CVE-2024-26165high

Elevation of Privilege Vulnerability

GHSA-54p6-6j68-j5vrFixed in 1.87.2, not held here
CVE-2023-39956high

Remote Code Execution Vulnerability

GHSA-5cm6-54wm-6gg6Fixed in 1.80.2, not held here
CVE-2023-36742high

Remote Code Execution Vulnerability

GHSA-r6q2-478f-5gmrFixed in 1.82.1, not held here
CVE-2023-33144high

Information Disclosure Vulnerability

GHSA-j5wm-6crw-xvmrFixed in 1.79.1, not held here
CVE-2023-29338high

Information Disclosure Vulnerability

GHSA-mmfh-4pv3-39hrFixed in 1.78.1, not held here
CVE-2023-24893high

Remote Code Execution Vulnerability

GHSA-4v3r-wv86-6mjjFixed in 1.77.1, not held here
CVE-2023-21779medium

Remote Code Execution Vulnerability

GHSA-p996-wrgh-crrjFixed in 1.74.3, not held here
CVE-2022-41034high

Remote Code Execution Vulnerability

GHSA-q6rv-h25q-6pj6Fixed in 1.71.1, not held here
CVE-2022-41042medium

Information Disclosure Vulnerability

GHSA-fj7x-w8c2-xx4cFixed in 1.71.1, not held here
CVE-2022-38020high

Elevation of Privilege Vulnerability

GHSA-6c5x-m47q-5xmfFixed in 1.71.1, not held here
CVE-2022-30129high

Remote Code Execution Vulnerability

GHSA-jfjw-mv65-hg44Fixed in 1.67.1, not held here
CVE-2022-26921high

Elevation of Privilege Vulnerability

GHSA-wrm3-w8h4-q8mxFixed in 1.66.2, not held here
CVE-2022-24526high

Spoofing Vulnerability

GHSA-9rwm-gmc5-vhrfFixed in 1.65.1, not held here
CVE-2022-21991high

Remote Code Execution Vulnerability

GHSA-5q6q-39p2-37cxFixed in 1.64.1, not held here