CVE-2026-69370

Awaiting Analysis Awaiting Analysis - Queue

Command Injection Vulnerability in Visual Studio Code

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69370

EUVD

EUVD-2026-99068

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Visual	Studio Code 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in Visual Studio Code. It allows an unauthorized attacker to execute arbitrary code remotely by sending specially crafted input that bypasses input validation.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially stealing data, installing malware, or taking control of your machine if you use the vulnerable version of Visual Studio Code.

Compliance Impact

This vulnerability allows unauthorized remote code execution, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection requirements and HIPAA's security rules for protected health information if exploited.

Mitigation Strategies

Update Visual Studio Code to the latest version as soon as possible to patch the command injection vulnerability. Monitor network traffic for unusual activity and restrict unauthorized access to development environments.

Hi! I’m here to help you understand CVE-2026-69370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70