Advisoriesby IbisRemote code execution through workspace-configured remote agent host connections
Impact
A remote code execution vulnerability exists in affected versions of Visual Studio Code. Remote agent host addresses and local-file permission grants could be read from workspace configuration, including an untrusted repository's .vscode/settings.json.
An attacker could convince a user to open a specially crafted repository that configures Visual Studio Code to connect to an attacker-controlled remote agent host. The repository could also supply permission settings that grant the remote agent host access to local files.
Successful exploitation could allow the attacker to access local data or execute code in the context of the user. User interaction is required because the user must open the crafted repository, but the user does not need to trust the workspace.
Patches
The fix is available starting with Visual Studio Code 1.136.2.
The fix ([4321a67](https://github.com/microsoft/vscode/commit/4321a67576d0d63e46d94af88d554b6cbe0193e4)) ensures that remote agent host addresses and persisted local-file permission grants are read only from global configuration rather than workspace configuration. It also marks the related configuration settings as restricted.
Users should update to Visual Studio Code 1.136.2 or later.
Workarounds
Avoid opening repositories from untrusted sources, particularly repositories containing a .vscode/settings.json file....
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Visual Studio Code Product | < 1.136.2 | 1.136.2 |
Details and references
## Impact A remote code execution vulnerability exists in affected versions of Visual Studio Code. Remote agent host addresses and local-file permission grants could be read from workspace configuration, including an untrusted repository's `.vscode/settings.json`. An attacker could convince a user to open a specially crafted repository that configures Visual Studio Code to connect to an attacker-controlled remote agent host. The repository could also supply permission settings that grant the remote agent host access to local files. Successful exploitation could allow the attacker to access local data or execute code in the context of the user. User interaction is required because the user must open the crafted repository, but the user does not need to trust the workspace. ## Patches The fix is available starting with **Visual Studio Code 1.136.2**. The fix ([4321a67](https://github.com/microsoft/vscode/commit/4321a67576d0d63e46d94af88d554b6cbe0193e4)) ensures that remote agent host addresses and persisted local-file permission grants are read only from global configuration rather than workspace configuration. It also marks the related configuration settings as restricted. Users should update to Visual Studio Code 1.136.2 or later. ## Workarounds Avoid opening repositories from untrusted sources, particularly repositories containing a `.vscode/settings.json` file. This precaution reduces exposure but is not a substitute for updating Visual Studio Code. ## References - [Visual Studio Code issue #335119](https://github.com/microsoft/vscode/issues/335119) - [Fix commit 4321a67](https://github.com/microsoft/vscode/commit/4321a67576d0d63e46d94af88d554b6cbe0193e4) - [MSRC entry for CVE-2026-78462](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78462) - [Visual Studio Code Workspace Trust documentation](https://code.visualstudio.com/docs/editor/workspace-trust)
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639