Skip to content

Python extension for Visual Studio Code Remote Code Execution Vulnerability

High
karthiknadig published GHSA-3jg7-gmqj-5gx7 Jul 8, 2025

Package

ms-python.python (VS Code Extension)

Affected versions

<= 2025.8.0

Patched versions

2025.8.1

Description

Impact

There is a security vulnerability in the untrusted workspaces flow with specially crafted workspaces.

Patches

The fix is available starting with 2025.8.1 fix is: 5e64d0e . Python extension is disabled in untrusted workspaces.

Workarounds

Check for python executables checked-into SCM before opening untrusted workspaces.

References

Severity

High

CVE ID

CVE-2025-49714

Weaknesses

Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message. Learn more on MITRE.