The vulnerability is a command injection flaw in Visual Studio Code. An attacker who can send specially crafted commands can cause the application to execute arbitrary code. This flaw arises from improper neutralization of special command elements (CWE‑77). The resulting impact is remote code execution on the host running VS Code.

Microsoft Visual Studio Code is the affected product. The CVE does not specify particular version ranges; therefore all releases before the official fix are considered vulnerable. No information is given about operating system dependencies or platform specifics.

The CVSS score of 8.8 classifies this issue as high severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector, as described, appears to be a remote network connection where an unauthenticated attacker can send commands to VS Code, allowing the injection to be executed.