CVE-2021-43891: exploitation status and patch state

CVE-2021-43891 · CVSS 7.8 HIGH · EPSS 13%

Visual Studio Code Remote Code Execution Vulnerability

Is CVE-2021-43891 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 13%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Microsoft · Visual Studio Code · >= 1.0.0, < 1.63.1

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2021-43891

• Git Metadata Punches Through AI Agent Sandboxes (2026-09-03)

Primary sources

• NVD record

What this record does not say

• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-09-03.