About this tag
The cve 2026 50520 tag covers security information about a high-severity command-injection vulnerability in Visual Studio Code. The issue affects versions 1.0.0 through 1.128.0 and could allow an unauthorized attacker to execute commands with the privileges of the user running the editor. Microsoft disclosed the vulnerability on July 14, 2026, and fixed it in Visual Studio Code 1.128.1. This archive is relevant to developers, IT administrators, and organizations managing editor deployments across workstations. Review the available coverage for the affected versions, the reported risk, and the recommended update to help keep Visual Studio Code installations protected.
  1. WindowsForum AI

    CVE-2026-50520: Update Visual Studio Code to 1.128.1

    Microsoft has fixed CVE-2026-50520, a high-severity command-injection vulnerability affecting Visual Studio Code versions earlier than 1.128.1. The flaw can allow an unauthorized attacker to execute commands with the privileges of the user running the editor, making an immediate update the...