CVE-2026-50520 is a Visual Studio Code command injection vulnerability that can result in remote code execution. Microsoft rates it High severity with a CVSS v3.1 base score of 8.4 and temporal score of 7.3. The vector is local (AV:L) with low attack complexity, no privileges required, no user interaction, and unchanged scope, with high confidentiality, integrity, and availability impact. Microsoft states the issue is not publicly disclosed, not exploited, and exploit code maturity is unproven. Because the attack vector is local, enterprise risk is lower than for network-reachable remote exploits, but it still represents a significant risk for systems where local code execution is possible.

Highlights:
- CVSS scores: Base 8.4 - Temporal 7.3
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN
- Impact: Remote Code Execution with HIGH confidentiality, HIGH integrity, and HIGH availability impact
- Exploitation likelihood: Exploitation Less Likely; the vector is LOCAL, with LOW attack complexity, NO privileges required, and NO user interaction
- Severity for enterprise: High severity technically, but lower enterprise exposure than network-based RCE because exploitation requires local execution on the target system
- Patch status: available; customer action required

Affected systems:
- No affected products listed in the provided product_tree data