Description
Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Microsoft Visual Studio Code CoPilot Chat Extension | 0.27.0 – < 0.27.2 | 0.27.2 |
| Microsoft | Visual Studio Code | 1.0.0 – < 1.100.1 | 1.100.1 |
Advisories 3
- WID-SEC-2025-1015 Microsoft Developer Tools: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 1, 2025
- MSRC-CVE-2025-21264 Visual Studio Code Security Feature Bypass Vulnerability Microsoft Security Response Center · Jun 17, 2025
- NCSC-2025-0153 Kwetsbaarheden verholpen in Microsoft Developer Tools NCSC-NL (Netherlands) · May 13, 2025
References
- Visual Studio Code Security Feature Bypass Vulnerability vendor-advisory patch