Nguyen Van Minh Duc

Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

Missing authentication for critical function in Visual Studio Code allows an authorized attacker to elevate privileges locally.

Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Reliance on untrusted inputs in a security decision allows an unauthorized attacker to bypass the Workspace Trust security feature over a network. Workspace Trust is designed to prevent malicious code from executing automatically when cloning or opening untrusted repositories.