Vulnerability record · CVE-2021-31213 · published 11 May 2021
CVE-2021-31213: Visual Studio Code Remote Containers Extension Remote Code Execution
Microsoft · Remote
The Visual Studio Code Remote Containers extension contains a remote code execution flaw. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact mechanism is unknown. It matters because a successful exploit yields full compromise of confidentiality, integrity and availability on the host running VS Code.
Description
Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityHigh CVSS impact (7.8) and a very high EPSS percentile outweigh the lack of KEV listing and thin technical detail.
What it is
The Visual Studio Code Remote Containers extension contains a remote code execution flaw. The record gives no root-cause detail beyond the CWE being 'insufficient information', so the exact mechanism is unknown. It matters because a successful exploit yields full compromise of confidentiality, integrity and availability on the host running VS Code.
Impact
An attacker who gets the victim to open a crafted workspace or container configuration can execute arbitrary code with the privileges of the VS Code user, gaining high confidentiality, integrity and availability impact.
Attack surface
The CVSS vector is local (AV:L) with user interaction required (UI:R) and no privileges required (PR:N), meaning the victim must open or interact with a malicious workspace or container definition in VS Code. No authentication is needed, but the attack is not remotely reachable without that user action.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at roughly 0.53 (99th percentile), indicating elevated likelihood of exploitation activity. The only references are Microsoft's patch advisory, so no public exploit details are confirmed in this record.
What to do
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2021-31213.
- Update the VS Code Remote Containers extension and VS Code itself to current supported versions.
- Restrict opening untrusted workspaces and container configurations; use Workspace Trust to block automatic execution in untrusted folders.
- Run VS Code and container tooling with least privilege, avoiding elevated or host-root contexts.
- Review and limit which container definitions and devcontainer.json files users can pull from external sources.
Detection
- Monitor for unexpected child processes spawned by VS Code or container runtime processes on developer endpoints.
- Alert on devcontainer.json or workspace files created or modified from untrusted or external sources.
- Audit VS Code extension installs and versions against the patched baseline.
- Watch for anomalous outbound network connections originating from VS Code or container helper processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31213 | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31213 | PatchVendor Advisory |
Track CVE-2021-31213 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Source: NIST National Vulnerability Database (record CVE-2021-31213), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
