CVE-2026-50520 HIGH

CVE-2026-50520: Visual Studio Code Remote Code Execution Vulnerability

Vendor Microsoft

Product Visual Studio Code

Weakness CWE-77

Published July 14, 2026

Last update July 24, 2026

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Local

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.

Key dates

02Disclosure timeline

July 14, 2026 CVE published

July 24, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-50520 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html AskarLabs — CWE-77 write-up Command Injection

Related vulnerabilities

04Related CVE

CVE-2023-6999 Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution CVE-2025-22630 WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability CVE-2024-37091 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability CVE-2024-34792 WordPress Dextaz Ping plugin <= 0.65 - Remote Code Execution (RCE) vulnerability CVE-2026-9834 WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter