CVE-2026-120779 Visual Studio Code Remote Code Execution Vulnerability
CriticalCVSS 9.6
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Visual Studio Code | < 1.145.3 | 1.145.3 |
| Microsoft Visual Studio Code | >= 1.0.0, < 1.145.3 | 1.145.3 |
References
- MSRC Security Update Guide patch vendor-advisory
- Release Notes patch
- Release Notes vendor-advisory