Microsoft ≫ Visual Studio Code

Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

An issue in the code-runner.executorMap setting of Visual Studio Code Extensions Code Runner v0.12.2 allows attackers to execute arbitrary code when opening a crafted workspace.

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.

Files or directories accessible to external parties in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper access control in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally.