CVE-2019-0728

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Visual Studio Code	unspecified

References

http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/106913Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0728Patch, Vendor Advisory
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/106913Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0728Patch, Vendor Advisory

Timeline

Published: Mar 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019