Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2374 articles · 112014 vulns · 38/41 feeds (7d)
← Back to list
8.0
CVE-2026-21523PATCHED
microsoft · visual_studio_code

GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability

Description

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Affected Products

VendorProductVersions
microsoftvisual_studio_code0.27.0, 1.0.0

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
canonicalubuntu linuxcert_advisory90%
microsoftmicrosoft visual studio codecert_advisory90%
microsoftvisual studiocert_advisory90%
microsoft.net frameworkcert_advisory90%

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21523(vendor-advisory, patch)

Related News (2 articles)

Tier A
Microsoft MSRC20h ago
CVE-2026-21523 GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
→ No new info (linked only)
Tier B
BSI Advisories14d ago
[UPDATE] [hoch] Microsoft DeveloperTools (Visual Studio Code und .NET): Mehrere Schwachstellen
→ No new info (linked only)
CVSS 3.18.0 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA KEV❌ No
Actively exploited❌ No
Patch available
1.109.2
CWECWE-367
PublishedFeb 10, 2026
Last enriched19d ago
Trending Score40
Source articles2
Independent2
Info Completeness9/14
Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

MEDIUMCVE-2026-32201EXPKEV
Microsoft SharePoint Server Spoofing Vulnerability
Trending: 141
HIGHCVE-2026-33825EXPKEV
Microsoft Defender Elevation of Privilege Vulnerability
Trending: 117
HIGHCVE-2026-21262EXPKEV
SQL Server Elevation of Privilege Vulnerability
Trending: 40
CRITICALCVE-2026-33824EXP
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Trending: 39
HIGHCVE-2026-32071EXP
Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Trending: 35

Pin to Dashboard

Verification

State: verified
Confidence: 100%

Vulnerability Timeline

CVE Published
Feb 10, 2026
Discovered by ZDM
Apr 1, 2026
Patch Available
Apr 10, 2026