SB2026090915 - Multiple vulnerabilities in Visual Studio Code
Published: September 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-70334)
CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass the Workspace Trust security feature.
The vulnerability exists due to an incomplete list of disallowed inputs in Visual Studio Code when opening an untrusted workspace. A remote attacker can use an input omitted from the disallowed list to bypass the Workspace Trust security feature.
User interaction is required to open the untrusted workspace.
2) Path traversal (CVE-ID: CVE-2026-78461)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass the Workspace Trust security feature.
The vulnerability exists due to improper limitation of a pathname to a restricted directory (path traversal) in Visual Studio Code when handling a crafted pathname. A remote attacker can use path traversal to bypass the Workspace Trust security feature.
User interaction is required.
3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-78462)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass Workspace Trust restrictions and execute code in the context of the user.
The vulnerability exists due to authorization bypass through user-controlled key in the Visual Studio Code Workspace Trust feature when opening a specially crafted workspace. A remote attacker can convince a user to open a specially crafted Visual Studio Code workspace to bypass Workspace Trust restrictions and execute code in the context of the user.
User interaction is required, but the user does not need to trust the workspace.
4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-81356)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass network access restrictions.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the Visual Studio Code agent when processing attacker-controlled content. A remote attacker can influence content so that the agent requests a specially crafted URL to bypass network access restrictions.
User interaction is required to run the agent against attacker-controlled content.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-81357)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass network access restrictions.
The vulnerability exists due to server-side request forgery (SSRF) in the Visual Studio Code agent when processing attacker-controlled content that contains a specially crafted URL. A remote attacker can cause the agent to request a specially crafted URL to bypass network access restrictions.
User interaction is required to run the agent against attacker-controlled content.
6) Incomplete Comparison with Missing Factors (CVE-ID: CVE-2026-81376)
CWE-ID: CWE-1023 - Incomplete Comparison with Missing Factors
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access local data or execute code in the context of the user.
The vulnerability exists due to incomplete comparison with missing factors in the Visual Studio Code Workspace Trust feature when opening a specially crafted workspace. A remote attacker can convince a user to open a specially crafted Visual Studio Code workspace to access local data or execute code in the context of the user.
The user does not need to trust the workspace.
7) Path traversal (CVE-ID: CVE-2026-81377)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with files.
The vulnerability exists due to improper limitation of a pathname to a restricted directory (path traversal) in Visual Studio Code when handling user-controlled pathnames. A remote attacker can use path traversal to access files outside a restricted directory to tamper with files.
User interaction is required.
8) Interpretation Conflict (CVE-ID: CVE-2026-81378)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass configured network access restrictions.
The vulnerability exists due to an interpretation conflict in the Visual Studio Code agent when processing attacker-controlled content that causes it to request a specially crafted URL. A remote attacker can influence the processed content to bypass configured network access restrictions.
User interaction is required to run the agent against attacker-controlled content.
9) Not Failing Securely ('Failing Open') (CVE-ID: CVE-2026-81379)
CWE-ID: CWE-636 - Not Failing Securely (\'Failing Open\')
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass configured network access restrictions.
The vulnerability exists due to not failing securely (\'failing open\') in the Visual Studio Code agent when processing attacker-controlled content. A remote attacker can influence content so that the agent requests a specially crafted URL to bypass configured network access restrictions.
User interaction is required to run the agent against attacker-controlled content.
10) Command injection (CVE-ID: CVE-2026-81380)
CWE-ID: CWE-77 - Command injection
CVSSv4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper neutralization of special elements used in a command in GitHub Copilot agent mode when processing attacker-controlled commands. A remote attacker can cause GitHub Copilot agent mode to send workspace data and environment variables to an attacker-controlled service to disclose sensitive information.
User interaction is required.
11) Insufficiently protected credentials (CVE-ID: CVE-2026-81381)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to insufficiently protected credentials in GitHub Copilot and Visual Studio Code when handling a user\'s work account sign-in access token. A remote attacker can obtain the token to disclose sensitive information.
User interaction is required.
12) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-81383)
CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose file contents.
The vulnerability exists due to use of an incorrectly resolved name or reference in Visual Studio Code when resolving names or references. A remote attacker can exploit an incorrectly resolved name or reference to disclose file contents.
User interaction is required. The accessible file content depends on the privileges of the compromised user.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-70334
- https://code.visualstudio.com/updates/v1_136
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-78461
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-78462
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81356
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81357
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81376
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81377
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81378
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81379
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81380
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81381
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-81383