CVE-2026-120779

CriticalCVSS 9.6/10Last modified Nov 10, 2026

Description

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1207808.3Improper access control in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-1207827.8Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security featureCVE-2026-1207836.4Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1207858.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207868.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207888.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207898.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-120796.5The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ’orderby’ parameter in all versions up to, and includinCVE-2026-1207908.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207918.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1207927.3Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.CVE-2026-1207965.3Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-120779: Critical severity, CVSS 9.6 | Vulnix