Python extension for Visual Studio Code Remote Code Execution Vulnerability

[karthiknadig]

There is a security vulnerability in the untrusted workspaces flow with specially crafted workspaces.

Patches

The fix is available starting with 2025.8.1 fix is: 5e64d0e

Workarounds

Check for python executables checked-into SCM before opening untrusted workspaces.

References

• The patch for this can be found at 5e64d0e
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49714
• Security advisory: GHSA-3jg7-gmqj-5gx7