vscode
1.146.0Visual Studio Code
- Maintenance
- Active12722 commits in 3 months · bus factor 7
- License
- MITPermissive · OSI-approved
- Security
- 30 advisories1 critical, 24 high, 5 medium · Scorecard 7.4/10
- Supported versions
- No scheduleendoflife.date does not track this project
195k stars · 43.8k forks · 21.5k open issues · last release 4 days ago · data checked 32 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 1 critical, 24 high, 5 medium. Check the patched version against the one you run.
- highCVE-2026-102230Nov 10, 2026Information Disclosure via Integrated Browser File Uploads
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121662Nov 10, 2026Workspace Trust Bypass via Prototype Pollution in Workspace Configuration
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121663Nov 10, 2026Workspace Trust Bypass via Settings Group Key Override
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121660Nov 10, 2026Security Feature Bypass via Inherited Publisher Names in Allowed Extensions Policy
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121664Nov 10, 2026Remote Code Execution via Extension Text Rendered as Markdown
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-119975Nov 10, 2026Command Injection via Crafted Publisher Names in the Extension Trust Dialog
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121665Nov 10, 2026Workspace Trust Bypass via Unregistered Experiment Override Settings
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-121661Nov 10, 2026Workspace Trust Bypass via Restricted Settings Written as Flat Dotted Keys
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- mediumCVE-2026-119976Nov 10, 2026Information Disclosure via Images on UNC Paths
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- mediumCVE-2026-120782Nov 10, 2026Command Execution via Agent-Originated Local Commands
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-120780Nov 10, 2026Remote Code Execution via serve-web Release Downgrade
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-120779Nov 10, 2026Remote Code Execution via MCP Elicitation Notifications
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-119985Nov 10, 2026Remote Code Execution via Network Workspace Trust Bypass
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-119983Nov 10, 2026Remote Code Execution via Unvalidated MCP SSE Endpoints
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-114171Nov 10, 2026Remote Code Execution via Malicious MCP Installation Links
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-70094Nov 10, 2026Remote Code Execution via JavaScript Debugger Auto-Attach
- Affected
- < 1.145.3
- Patched in
- 1.145.3
- highCVE-2026-78461Oct 13, 2026Security Feature Bypass via Notebooks
- Affected
- < 1.136.2
- Patched in
- 1.136.2
- highCVE-2026-69370Oct 13, 2026Remote Code Execution via Workspace-injected Error Notification Link
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-70098Oct 13, 2026Remote Code Execution via Skipped Workspace Trust
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- mediumCVE-2026-102851Oct 13, 2026Security Feature Bypass via Shared MCP Sandbox Permission Approvals
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- mediumCVE-2026-102229Oct 13, 2026Information Disclosure via Remote Webview Resource Path Traversal
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-102231Oct 13, 2026Security Feature Bypass via Azure DevOps Code Search Endpoint Override
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-102233Oct 13, 2026Workspace Trust Bypass via Terminal Relaunch and Reuse
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-102234Oct 13, 2026Workspace Trust Bypass via Terminal Allowed Link Schemes Setting
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-102235Oct 13, 2026Remote Code Execution Vulnerability
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-102232Oct 13, 2026Remote Code Execution via Custom Hook Edits in the Copilot Harness
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- criticalCVE-2026-102238Oct 13, 2026Path Traversal and Workspace Trust Bypass
- Affected
- < 1.141.1
- Patched in
- 1.141.1
- highCVE-2026-81378Sep 8, 2026Agent Network Filter Security Feature Bypass
- Affected
- < 1.136.2
- Patched in
- 1.136.2
- highCVE-2026-81357Sep 8, 2026Agent Network Filter Security Feature Bypass
- Affected
- < 1.136.2
- Patched in
- 1.136.2
- mediumCVE-2026-81380Sep 8, 2026Information Disclosure through Automatic Remote Image Fetch in Chat
- Affected
- < 1.136.2
- Patched in
- 1.136.2