Command Injection in Microsoft Visual Studio Code Enables Network Code Execution

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

• Microsoft Visual Studio Code: versions from 1.0.0 through versions less than 1.141.1 are marked affected.
• The record does not identify additional products, plugins, modules, or parallel release branches as affected.
• The status of branches or releases outside the stated range remains unverified.

Microsoft Visual Studio Code contains a command injection flaw caused by improper neutralization of special elements used in a command. The flaw allows attacker-influenced command content to reach a command-processing path, but the record does not identify the input channel, endpoint, or specific processing component. Exploitation can occur over a network without prior privileges, but user interaction is required. The recorded attack complexity is low. The record does not establish which command is affected, the exact execution context, or any additional configuration conditions that could change the scope of exposure.

• Reachability: Network.
• Authentication and privileges: The attacker does not need prior authorization or assigned privileges.
• Complexity: Low.
• User interaction: Required, because a user must perform the action needed to trigger the affected processing path.
• Exploitation status: The supplied record marks public exploit as false, and the returned CISA enrichment records exploitation as none. This describes the available evidence and does not prove that exploitation has never occurred in every environment.

The flaw can result in arbitrary code execution within the security context of the Microsoft Visual Studio Code process after the required user interaction occurs. The supplied vector indicates unchanged scope, but the record does not establish privilege escalation, persistence, lateral movement, or crossing into another security authority. If execution succeeds, the confidentiality, integrity, and availability of resources accessible to the process could be affected. The precise consequences depend on the user's privileges and the data available at the time of exploitation.

Successful exploitation could allow code execution on a system running Microsoft Visual Studio Code, potentially affecting data, source code, and workstation operations. The practical risk depends on the user's privileges, the data available on the system, and endpoint controls, none of which are specified in the record. Because user interaction is required, workflows that open or process content from untrusted network sources may increase exposure. The supplied evidence does not identify a specific campaign, victim, or breach.

1. Update Microsoft Visual Studio Code to 1.141.1, which is outside the supplied affected range.
2. Prioritize workstations that can receive or process content from untrusted network sources and systems used to develop or maintain important source code.
3. Recheck inventory after updating to confirm that installations no longer fall within the affected range.
4. The record does not provide a specific alternative mitigation. The status of parallel release branches is not confirmed, so their safety should not be inferred from the stated fixed boundary alone.

1. Inventory all workstations and development environments where Microsoft Visual Studio Code is installed.
2. Compare installed versions with the affected range in affected_summary.
3. Identify systems that can receive content or requests from untrusted network sources and prioritize them for updating.
4. As a precaution, review endpoint telemetry for unexpected code execution associated with Visual Studio Code after sessions involving suspicious network content. The record provides no specific IOC, log event, or process pattern, and the absence of such evidence does not prove that a system is safe.