Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-120779: Visual Studio Code lets attackers run code remotely

CVE-2026-120779 · published 1 day ago

Summary

Visual Studio Code can be tricked into executing code sent over a network, allowing an unauthorized person to run commands on your system. This could let an attacker access or modify your data. Update Visual Studio Code to the latest version and apply any security patches as soon as they are released.

What to do

Update microsoft visual studio code to version 1.145.3 or later.

Affected software

Vendor	Product	Affected versions
microsoft	visual studio code	< 1.145.3

Original advisory text

Visual Studio Code Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120779 vendor-advisory patch

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.6 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published10 Nov 2026

Updated12 Nov 2026

First seen10 Nov 2026

Sources

CVE-2026-120779 · NVD

CVE-2026-120779 · MITRE

Track software like this

Free during beta