Vulnerabilities
CVE-2026-69370: Visual Studio Code Remote Code Execution via Command Injection
A command injection flaw in Visual Studio Code enables attackers to execute arbitrary code remotely. All versions that accept untrusted input in the command execution path are affected. Defenders should apply the latest update and audit remote access settings.
What Happened
An improper neutralization of special elements in Visual Studio Code’s command handling allows an attacker to inject shell commands. The flaw is exploitable over the network, enabling remote code execution on the target machine.
Who Is Affected
All installations of Visual Studio Code that process untrusted input in the editor’s command execution path, regardless of operating system. The issue is present in versions prior to the latest security release.
Impact
Remote attackers can run arbitrary code with the privileges of the VS Code process, potentially compromising the host system, accessing sensitive data, or pivoting to other network resources.
Mitigation Steps
- Update Visual Studio Code to the latest version that contains the patch for CVE-2026-69370.
- Disable or restrict remote command execution features if they are not required.
- Implement network segmentation and firewall rules to limit inbound connections to the VS Code service.
- Monitor for anomalous command execution activity and enforce least‑privilege execution policies.
Additional Guidance
Regularly review the VS Code release notes for security updates and apply them promptly. Consider using endpoint protection that flags unexpected command execution patterns.
Related vulnerabilities
Visual Studio Code Path Traversal Vulnerability (CVE-2026-102229) – Information Disclosure
A path traversal flaw in Visual Studio Code allows an authenticated user to read arbitrary files on the host via network requests. All versions are affected; apply the latest update or restrict network exposure.
Read briefing
Visual Studio Code CVE‑2026‑81357: Security Feature Bypass Vulnerability
Microsoft has disclosed CVE‑2026‑81357, a flaw in Visual Studio Code that allows attackers to bypass a built‑in security feature. The vulnerability could enable malicious code execution or privilege escalation. Defenders should verify their VS Code version and apply the latest update immediately.
Read briefing
OpenOffice Versions <4.1.17 Vulnerable to Remote Code Execution (CVE‑2026‑59265, CVE‑2026‑63277)
Multiple CVEs have been identified in OpenOffice versions older than 4.1.17 that enable remote code execution. The flaws allow an attacker to trigger arbitrary code on a target system via crafted documents. Defenders must apply the vendor’s patches immediately or upgrade to a supported release.
Read briefing
CVE-2026-96957 .NET Security Feature Bypass – Informational Update
Microsoft updated the Security Updates table with KB links for .NET 11.0 and Visual Studio, clarifying that the fixed builds remain unchanged. Defenders should confirm they run the latest patched .NET version and keep Visual Studio updated.
Read briefing