Visual Studio Code

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical - deserialization of untrusted data or code injection, high-quality report │ $15,000 │ $16,000 Critical - authentication issues, improper access control, SSRF, or SQL and command injection │ $12,000 │ $13,000 Important - deserialization of untrusted data or code injection │ $10,000 │ $11,000 Critical - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $8,000 │ $9,000 Important - authentication issues, improper access control, SSRF, or SQL and command injection │ $6,000 │ $7,000 Critical - GitHub Actions in the repository │ $5,000 │ $6,000 Important - XSS, CSRF, cross-origin access, improper input validation, web misconfiguration │ $4,000 │ $5,000 Important - GitHub Actions in the repository │ $3,000 │ $3,750 Moderate and Low, every vulnerability type │ $0 │ $0 Submit a vulnerability CVE history 15 Last 12 months 34 Lifetime Code execution 45 % Access control 20 % Info disclosure 20 % XSS 10 % Latest advisories Loading the feed Overview Visual Studio Code is the most widely used code editor in the world and the base layer for an entire generation of derived products: Cursor, Windsurf, GitHub Codespaces, VSCodium, Gitpod and most vendor-branded cloud IDEs are forks or embeddings of this repository. It is installed on developer workstations and CI images, it opens arbitrary untrusted repositories by design, and it holds cloud credentials, SSH keys and signing material in the same process space, which is why workspace trust and the extension-host boundary are load-bearing rather than cosmetic. It is also the most active CVE producer in this niche by a wide margin, with 15 advisories in the last twelve months. Microsoft pays it through the MSRC Researcher Portal on the Open Source Bounty Program, where the bounty asset is the MIT Code - OSS repository rather than the proprietary branded build, and a high-quality Critical report in the deserialization or code-injection class tops out at $15,000. sorona.xyz adds 1.25x on top of whatever Microsoft awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Microsoft's SCOPE list names Visual Studio Code and hyperlinks it to github.com/microsoft/vscode, so the asset is that MIT Code - OSS repository in full, at Critical or Important severity on the most recent actively maintained branch The editor core and workbench: window and workspace handling, file and folder opening, settings, profiles and Settings Sync, and the code command line The extension host, the extension API surface, and the marketplace install and update flow Workspace trust and Restricted Mode, covering everything the editor does with a repository before trust has been granted The .vscode/ configuration machinery: tasks, launch configurations, the debug adapter protocol and the language server protocol clients Remote Development: the SSH, Dev Containers, WSL and Codespaces attach paths, and the server component the editor installs on the remote host Webviews, notebook and markdown renderers, custom editors, and the URI and protocol handlers the editor registers with the operating system The integrated terminal, the built-in Git and GitHub authentication providers, and the credential storage behind them The built-in extensions and language grammars that ship inside the repository The Electron and Chromium integration the repository owns, plus its update and download paths The repository's own GitHub Actions workflows, which the reward grid prices on a row of their own Out of scope Anything that requires a non-default third-party extension to be installed Issues that only exist in the proprietary branded distribution and are not present in Code - OSS Samples, tutorials, quickstart code and samples/ directories Documentation-only fixes Publicly disclosed issues Dependency confusion reports Moderate and Low severity, which this grid pays $0 for in every vulnerability class Findings that only reproduce on a branch other than the most recent actively maintained one Payment to a researcher who does not return an IRS tax form within 30 calendar days of validation, or who does not clear sanctions screening Most-valued findings A workspace trust or Restricted Mode bypass that gets code running from a repository the user only opened to read: this is the code-injection class that carries the $15,000 top band, and VS Code's place in the local-machine carve-out means purely local impact still pays An extension-host sandbox escape that reaches the main process, the user's stored credentials, or the filesystem outside the workspace Task or debug-adapter configuration inside .vscode/ that executes without passing the consent gate A Remote Development, Dev Containers or Codespaces attach path that runs attacker-controlled code on the remote host or leaks the connection's credentials A webview or notebook renderer isolation break that turns rendered document content into script in a privileged editor context Workflow injection in the repository's own GitHub Actions, which the grid prices separately at up to $5,000 for a Critical Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Only Critical and Important severity qualify; Moderate and Low findings pay $0 under this program Reproduce on the most recent actively maintained branch of Code - OSS, not on an old release Local-machine-only impact is payable here, because Visual Studio Code is named in the program's local-machine carve-out Anything that depends on a non-default third-party extension is excluded, so show the bug against a stock install Follow coordinated vulnerability disclosure: Microsoft requires bounty submissions stay confidential while it fixes, and imposing a fix deadline forfeits eligibility Return an IRS tax form (W-9, W-8BEN or 8233) within 30 calendar days of validation, and expect sanctions screening Disclosure Coordinated through MSRC, which keeps the submission confidential until a fix ships and then publishes a repository advisory with researcher credit; this repo is unusually prompt about it, with 15 advisories in the last year. Because the program's confidentiality terms read directly on third-party disclosure, file with MSRC yourself first and send sorona.xyz the case ID. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability