CVE-2026-21523

HIGH 8.0CVE-2026-21523 · Published 10/02/2026 · updated 17/06/2026

In short

CVE-2026-21523 is a HIGH (CVSS 8.0) vulnerability affecting visual studio code (microsoft).
Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 55.8% of all vulnerabilities.
Fix: update to 1.109.2 or later.

Package	Affected versions	Patched versions
visual studio code microsoft	`< 1.109.2`	`1.109.2`

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

< 1.109.2

1.109.2

More vulnerabilities in visual studio code

See all →