CVE-2026-70335

HighCVSS 7.8/10Last modified Oct 24, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-703368.8Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a netwoCVE-2026-703378.8Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.CVE-2026-703387.8Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security featuCVE-2026-703395.4Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute CVE-2026-70348.8A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet CVE-2026-703408.8Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-703418.8Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.CVE-2026-703428.1Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network.CVE-2026-703438.8Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.CVE-2026-703447.8Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-703457.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-703467.8Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.