CVE-2026-81380: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Microsoft Visual Studio Code

This vulnerability, identified as CWE-77 (Improper Neutralization of Special Elements used in a Command), affects Microsoft Visual Studio Code and GitHub Copilot. It allows an attacker without privileges to cause information disclosure over a network by exploiting improper sanitization of command elements. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high confidentiality impact. Microsoft has published an official fix for affected versions.

An unauthorized attacker can exploit this vulnerability to disclose sensitive information over a network. There is no impact on integrity or availability according to the CVSS vector. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users should apply the update to Visual Studio Code version 1.136.2 or later to remediate this vulnerability. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81380 for detailed patching instructions.