CVE-2026-70336: 
Visual Studio Code vulnerability analysis and mitigation

CVE-2026-70336 is a code injection vulnerability (CWE-94) in Microsoft Visual Studio Code that allows an authenticated network attacker with low privileges to execute arbitrary code remotely. It affects all versions of Visual Studio Code prior to 1.132.1. The vulnerability was disclosed and patched on August 11, 2026, as part of Microsoft's August 2026 Patch Tuesday release. It carries a CVSS v3.1 base score of 8.8 (High) (Microsoft MSRC, Github Advisory).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning Visual Studio Code fails to properly neutralize externally-influenced input that is used to construct or influence code segments, allowing an attacker to inject and execute arbitrary code. The attack vector is network-based with low attack complexity, requiring low privileges and no user interaction according to the primary CVSS scoring from Microsoft, though the GitHub Advisory notes a variant requiring user interaction with no privileges required. Exploitation is mapped to CAPEC-242 (Code Injection), CAPEC-35 (Leverage Executable Code in Non-Executable Files), and CAPEC-77 (Manipulating User-Controlled Variables) (Microsoft MSRC, Github Advisory).

Successful exploitation grants an attacker full control over the affected Visual Studio Code instance, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive data accessible to the VS Code process, modify files and system configurations, and crash or disrupt the service. The technical impact is rated as "total" by SSVC assessment, meaning all three security pillars are fully compromised (Microsoft MSRC).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Microsoft MSRC). The SSVC assessment indicates the vulnerability is not automatable. The EPSS score is approximately 0.64%, placing it in the 46th percentile for exploitation probability within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Github Advisory).

Microsoft has released a patch addressing this vulnerability in Visual Studio Code version 1.132.1. Users should update to version 1.132.1 or later immediately via the VS Code built-in update mechanism or by downloading the latest release from the official Microsoft website. As an interim measure, restricting network access to VS Code instances to trusted networks and users only is recommended, and administrators should monitor VS Code logs for suspicious code injection attempts (Microsoft MSRC).

The vulnerability was covered as part of broader August 2026 Patch Tuesday reporting, with coverage from security outlets including CyberSecurityNews, GBHackers, Rapid7, and Cryptika, the latter noting the August 2026 Patch Tuesday addressed approximately 394 vulnerabilities including 3 zero-days. Kaspersky and Tenable also flagged the vulnerability in their respective tracking systems. Community discussion was observed on Bluesky, though no significant independent researcher commentary or controversy has been noted (CyberSecurityNews, Rapid7).