{"id":"CVE-2026-69370","published":"2026-10-13T19:18:54.530","lastModified":"2026-10-13T23:17:34.680","description":"Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69370","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Visual Studio Code is vulnerable to command injection attacks that allow remote attackers to execute arbitrary code on the system. This occurs when special command elements are not properly neutralized, creating a pathway for malicious commands to be executed through the IDE.","exploitability":"Exploitation requires a remote attacker with network access to Visual Studio Code, and is relatively straightforward once an injection point is identified in command execution contexts.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise, data exfiltration, or lateral movement within the network.","remediation":"Upgrade to Visual Studio Code version 1.95.0 or later to remediate this command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","ide","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:54:08.426Z"}}