A command injection flaw in Visual Studio Code allows an attacker to provide special elements that are improperly neutralized in shell commands. This flaw can leak internal information over the network, compromising confidentiality of data visible to the malicious process. The weakness is identified as CWE‑77, which indicates that the application does not correctly sanitize or validate command input.

The vulnerability affects Microsoft Visual Studio Code. No specific version range is listed in the current data, so all installations running an unpatched version are potentially at risk.

The CVSS score of 6.5 classifies the issue as medium severity, while the EPSS score of < 1% indicates a low likelihood of exploitation today. The vulnerability is not yet listed in the CISA KEV catalog. The attack likely requires an attacker to inject crafted input into VS Code, possibly via a local user or a compromised extension; it is not explicitly described as a remote network exploitation vector, so the vector is inferred to be local access or a trusted execution context. When successful, the attacker can use the command injection to read process or system information that is then leaked over the network.