CVE-2026-69370

Summary

Visual Studio Code is vulnerable to command injection attacks that allow remote attackers to execute arbitrary code on the system. This occurs when special command elements are not properly neutralized, creating a pathway for malicious commands to be executed through the IDE.

Exploitability

Exploitation requires a remote attacker with network access to Visual Studio Code, and is relatively straightforward once an injection point is identified in command execution contexts.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Visual Studio Code version 1.95.0 or later to remediate this command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.