CVE-2026-70335

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Neutralización incorrecta de elementos especiales utilizados en un comyo del sistema operativo (’inyección de comyos del SO’) en GitHub Copilot y Visual Studio Code permite a un atacante no autorizado elevar privilegios localmente.

Information

Published : 2026-08-11 17:19

Updated : 2026-10-24 16:10

NVD link : CVE-2026-70335

Mitre link : CVE-2026-70335

CVE.ORG link : CVE-2026-70335

JSON object : View

Products Affected

microsoft

visual_studio_code

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-70335", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-70335", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T18:20:24.546154Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@microsoft.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secure@microsoft.com", "affectedData": [{"vendor": "Microsoft", "product": "Visual Studio Code", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.132.1", "versionType": "custom"}]}]}], "published": "2026-08-11T17:19:11.153", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@microsoft.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally."}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comyo del sistema operativo (\u2019inyecci\u00f3n de comyos del SO\u2019) en GitHub Copilot y Visual Studio Code permite a un atacante no autorizado elevar privilegios localmente."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA5D3EF3-09B9-466B-A9B4-BA8A955061E0", "versionEndExcluding": "1.132.1"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}