First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-70335

HighCVSS 7.8/10Last modified Oct 24, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Microsoft	Visual Studio Code	>= 1.0.0, < 1.132.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70335Patch, Vendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-703368.8Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a netwo CVE-2026-703378.8Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.CVE-2026-703387.8Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security featu CVE-2026-703395.4Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute CVE-2026-70348.8A vulnerability was found in Tenda FH1202 1.2.0.14(408). Affected by this issue is the function WrlExtraSet of the file /goform/WrlExtraSet CVE-2026-703408.8Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.CVE-2026-703418.8Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.CVE-2026-703428.1Use after free in Windows Ancillary Function Driver for WinSock allows an unauthorized attacker to elevate privileges over a network.CVE-2026-703438.8Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network.CVE-2026-703447.8Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-703457.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-703467.8Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-70335: High severity, CVSS 7.8 | Vulnix