Skip to content
OpenAdvisories
High MSRC-CVE-2026-70336 1 CVE

Visual Studio Code Remote Code Execution Vulnerability

Published Aug 11, 2026 · Updated Sep 2, 2026 · Revision 2

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could craft a malicious link or web page and use social engineering to convince a user to open it in Visual Studio Code. Successful exploitation could result in code execution in the user's connected development environment. User interaction is required to open the attacker-supplied link, and no authentication is needed.

Security updates
1.132.1 — https://code.visualstudio.com/updates/v1_132

Vulnerabilities 1

  • High 8.8
    CVE-2026-70336

    Visual Studio Code Remote Code Execution Vulnerability

    Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

    Microsoft Visual Studio Code

Revision history

  1. #2

    Affected software updated with new package information.

  2. #1

    Information published.

References