Remote Code Execution Vulnerability in Agentic AI and Visual Studio Code
CVE-2025-55319

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Visual Studio Code
Vendor
CVE Published:
12 September 2025

What is CVE-2025-55319?

A command injection vulnerability exists in both Agentic AI and Visual Studio Code, potentially allowing unauthorized attackers to execute arbitrary code over a network. This security flaw enables attackers to manipulate commands executed by these applications, posing a significant security risk to users and systems relying on this software. Users are urged to apply the necessary patches and updates to mitigate exposure to this vulnerability.

Affected Version(s)

Visual Studio Code Unknown 1.0.0 < 1.104.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.