An attacker can trigger an OS command injection in the remote functionality of Visual Studio Code, enabling the execution of arbitrary operating‑system commands. Because the injection occurs in code executed on the machine hosting the VS Code server, the attacker gains complete code‑execution privileges, compromising confidentiality, integrity, and availability. The vulnerability is caused by improper neutralization of special elements used in an OS command, classified as CWE‑78.

Microsoft Visual Studio Code. No explicit product version is listed, so any instance where the remote development features are enabled and exposed to a network is potentially vulnerable. This includes standard VS Code installations that accept remote connections.

The CVSS score of 8.8 classifies the vulnerability as high severity, and the EPSS of less than 1% indicates a low current threat likelihood, though exploitation remains possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthorized network connection to the VS Code server; an attacker can trigger the injection by sending a specially crafted request over the network, giving full code‑execution rights. Systems should consider this a significant risk and aim for timely patching, while monitoring network traffic for suspicious VS Code remote connections.