CVE-2025-55319: 
Visual Studio Code vulnerability analysis and mitigation

A critical vulnerability identified as CVE-2025-55319 was discovered in Agentic AI and Visual Studio Code. The vulnerability was disclosed on September 11, 2025, and allows unauthorized attackers to perform command injection attacks over a network. The affected software includes Microsoft Visual Studio Code version 1.104.0 and associated Agentic AI components (NVD, ManageEngine).

The vulnerability is classified as a command injection flaw (CWE-77) that allows for remote code execution. It has received a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), but does need user interaction (UI:R). The impact metrics show high severity for confidentiality, integrity, and availability (NVD).

The vulnerability poses significant risks as it allows attackers to execute arbitrary code on affected systems. With high impact ratings across confidentiality, integrity, and availability, successful exploitation could lead to complete system compromise, data theft, and service disruption (NVD).

Microsoft has released version 1.104.0 of Visual Studio Code (x86) which addresses this vulnerability. Users are advised to update to this version to mitigate the risk (ManageEngine).