CVE-2025-55319 is a high severity (8.8) command injection in Visual Studio Code and its agentic AI features, published 12 September 2025. The record says an unauthorized attacker can execute code over a network. Microsoft's advisory holds the fixed build, so update VS Code and check that page.
What's affected
The record names Microsoft Visual Studio Code and describes the flaw as AI command injection in Agentic AI and Visual Studio Code. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. In that vector, user interaction is required, so a person has to take some action for the attack to work, and the impact on confidentiality, integrity and availability is high.
The record has only one reference, the Microsoft Security Response Center entry. That page loads its details with a script, and we could not read the affected and fixed build numbers from it. We therefore do not state a fixed version here. Open the advisory and read the "fixed version" field for your update channel.
The record does not mark the CVE as exploited in the wild on the CISA KEV list.
How to check if you're exposed
- In VS Code, open About (Help menu on Windows and Linux, Code menu on macOS) and note the version.
- From a terminal, the
codecommand prints the version and commit when you pass its version option. - Compare the number with the fixed build on the Microsoft advisory.
- Check which AI assistant or agent extensions are installed from the Extensions view, or with the
codecommand's list extensions option. - For a fleet, read the editor version from your endpoint management tool, and include developer containers and remote hosts that run their own VS Code server.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It is built for package manifests, so it will not see a standalone server or a PHP project you downloaded as a zip. For those, an asset inventory of what you run is the starting point.
What to do now
- Update Visual Studio Code to the latest stable release. Most installs update themselves, but managed machines often hold updates back.
- Confirm the version against the fixed build in the Microsoft advisory.
- Until the update lands, be careful when an AI agent proposes to run a command or a tool, and read it before you approve it.
- Do not open untrusted repositories, files or web content with agent features switched on if you have not updated.
- Update the agent and AI extensions too, since they ship on their own schedule.
- Tell developers that agent approvals deserve the same attention as running a script from an unknown source.
Why it matters
The class is CWE-77: command injection, where text that is not trusted ends up inside a command that something then runs. With agentic features, the text can come from places a person does not read closely, such as a project file or a model's output. The editor then holds the user's own rights on a developer machine, which usually means source code, tokens and cloud credentials.
The record is short and does not describe the exact path, so we will not guess at it. The lesson is general. Treat any tool that turns text into actions as a code execution surface, keep it patched, and keep approval prompts meaningful.
Quick check
Do I need to do anything if VS Code updates itself?
Confirm the installed version against the fixed build on the Microsoft advisory. Managed or offline machines often lag behind, so check them rather than assume.
Where is the fixed version listed?
On the Microsoft Security Response Center page for CVE-2025-55319. The CVE record cites that page and no other reference.
Sources
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55319 (listed in the CVE record)
- Safeguard Gold entry for CVE-2025-55319
Last reviewed: 18 October 2026.
