VS Code command injection lets attackers run code over the network

high severity · published 2026-08-11

An unauthenticated attacker can inject special characters into an OS command and make Visual Studio Code run their code over the network. That means arbitrary code execution on the machine with the rights of the VS Code process.

Fixed in: 1.132.1

CVE: CVE-2026-69320

Source: NVD

Am I affected?

You are affected if the installed version is older than 1.132.1. Check the version you have and update to 1.132.1 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 155 and your operating system.