Improper control of code generation, also known as code injection, allows an unauthorized attacker to execute arbitrary code over a network. This flaw is classified as CWE-94 and results in remote code execution, threatening confidentiality, integrity, and availability of the affected system.

Microsoft Visual Studio Code. No specific version information is provided; the vulnerability applies to all builds of Visual Studio Code that have not applied the latest update. The exact scope of affected releases is not detailed in the available data.

With a CVSS score of 8.8 the vulnerability is considered high severity. The EPSS score is less than 1%, indicating a low but non-zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a network-based approach where the attacker gains access to the VS Code process. The exact prerequisites for exploitation are not specified, so it is assumed that any user with network reach to the victim’s VS Code instance could trigger the flaw.