CVE-2026-69370: Visual Studio Code Remote Code Execution Vulnerability
Published Oct 13, 2026
·Updated
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
Other sources
Visual Studio Code Remote Code Execution Vulnerability
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Visual Studio Code<1.141.1
1.141.1
Microsoft Visual Studio Code
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.141.1
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:59 PM
Data Sourced
via MITRE·06:59 PM
DescriptionSeverity
Frequently Asked Questions
1
Does an attacker need an account or prior privileges to exploit this issue?
No. The CVSS vector indicates that no privileges are required and that the attack can be carried out over a network with low attack complexity.
2
Is user interaction required for exploitation?
Yes. The CVSS vector marks user interaction as required, so exploitation depends on an affected user taking some action.