Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2020-1171
Microsoft Python extension for Visual Studio Code — Visual Studio Code Python Extension Remote Code Execution Vulnerability
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N R U H H H 8.8 .0504 92.0 —
AFFECTED
Product Versions Fixed
Python extension for Visual Studio Code 2020 – —
TIMELINE
Nov 4 Reserved by microsoft
May 21 Published (CNA: microsoft)
Aug 19 ENRICHED — CVE-2020-1171 (Microsoft Python extension for Visual Studio Code). Received CVSS 8.8 and CPE data from NVD.
Description
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
To exploit this vulnerability, an attacker would need to convince a target to clone a repository and open it in Visual Studio Code with the Python extension installed. Attacker-specified code would execute when the target opened the integrated terminal.
The update address the vulnerability by modifying the way Visual Studio Code Python extension handles environment variables.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| November 4, 2019 | Reserved | Reserved by microsoft |
| May 21, 2020 | Published | Published (CNA: microsoft) |
| August 19, 2026 | ENRICHED | ENRICHED — CVE-2020-1171 (Microsoft Python extension for Visual Studio Code). Received CVSS 8.8 and CPE data from NVD. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Microsoft | Python extension for Visual Studio Code | — | 2020 | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-1171 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
