Visual Studio Code
Product · by MicrosoftVulnerabilities
2 CVEs in our records, 0 known exploited (on CISA's KEV list).
Source: NVD and CISA KEVAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2021-42322 before 1.16.2 · fixed in 1.16.2
- CVE-2021-34528 before 1.58.1 · fixed in 1.58.1
Security timeline
- Malware reported by GBHackersTrojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
- Vulnerability reported by Help Net SecurityEmbedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Recent news
Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.