CVE-2026-70336 is a high severity flaw in Visual Studio Code, scored 8.8 by the record. Per the NVD record, it allows an unauthorized attacker to execute code over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: Visual Studio code.
The record describes the issue this way: Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
The record gives a CVSS 3.1 base score of 8.8 (HIGH), published 2026-08-11, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector reads as follows. Access is over the network, attack complexity is low, and privileges required are none. A user has to take some action. Scope is unchanged. Confidentiality, integrity and availability impact are high, high and high.
The advisory is the authority on build numbers, and our automated fetch of the Microsoft page returned no advisory text, so this guide stops at what the NVD record states. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
Check the installed editor version on each workstation, then compare it to the fixed version in the advisory.
code --version
Visual Studio Code normally updates itself, but managed images, locked-down desktops and developer containers often pin an older build. Look at those first.
What to do now
- Read the Microsoft advisory and note the fixed Visual Studio Code version.
- Update the editor on every workstation, build image and dev container.
- Until updated, avoid opening untrusted content or links from untrusted sources in the editor.
- Confirm the version on a sample of machines.
Why it matters
CWE-94 (code injection) describes a weakness where input is treated as code and executed, rather than handled as plain data.
Desktop software processes content that arrives from outside the company, such as documents, links and extensions. That makes user behavior and update discipline part of the exposure, and it is why patching speed varies so much between teams.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Does this need user interaction?
Yes. The vector sets user interaction to required, so a person has to do something in the editor for the attack to proceed.
Sources
- Microsoft Security Update Guide entry for CVE-2026-70336 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-70336 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
