Vulnerabilities - Structured Text language Support - Visual Studio Code

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/08/23

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

high

8.7

CVE-2026-26996

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) via glob patterns with consecutive * wildcards.

Exploits Exist

Fix Available

high

7.7

CVE-2026-13149

brace-expansion is vulnerable to denial of service via exponential-time complexity in the expand function.

Fix Available

high

7.5

CVE-2026-14257

brace-expansion is vulnerable to denial of service via memory exhaustion due to unbounded expansion length.

Fix Available

high

7.5

CVE-2026-27903

minimatch is vulnerable to a Regular Expression Denial of Service (ReDoS) via the matchOne function, allowing an attacker to stall the Node.js event loop for tens of seconds.

Exploits Exist

Fix Available

high

7.5

CVE-2026-27904

minimatch is vulnerable to a ReDoS issue due to nested *() extglobs producing regexps with catastrophic backtracking.

Exploits Exist

Fix Available

high

7.5

CVE-2026-33750

The brace-expansion library is vulnerable to a denial of service due to excessive looping caused by a zero-step value in a brace pattern.

Fix Available

Structured Text language Support

SAFE Assessment

Compliance

Security

Threats

Did you know...